3 ms·

I think it's crazy that we're considering "settling" for a 128-bit hash function that we won't even start to adopt until 5-10 years from now, when Google is alr

by mtgx 9y ago

I think it's crazy that we're considering "settling" for a 128-bit hash function that we won't even start to adopt until 5-10 years from now, when Google is already planning to announce its 49-qubit quantum computer by the end of this year. It's also very likely that quantum computers will scale at a "Moore's Law" of sorts rate (doubling the qubits every 2 years or so, if not even faster in the first few years). We've seen that with D-Wave already. http://spectrum.ieee.org/computing/hardware/google-plans-to-demonstrate-the-supremacy-of-quantum-computing http://spectrum.ieee.org/computing/hardware/google-plans-to-... I feel the same about all of those "faster" (read: weaker) IoT-optimized crypto algorithms that are being proposed right now for standardization. What we should be talking about now is quantum-resistant algorithms that are likely to be even slower than SHA-3, but would at least protect communications against quantum computers. We need them soon, because they'll have to be deployed on 80%+ of the internet by 2030 or so, and we know how slow the internet ecosystem is at adopting a new protocol.

johncolanduoni 9y ago
Quantum computers are pretty unlikely to follow anything like Moore's law. They are fundamentally difficult to scale up due to decoherence and compounding of errors, a property that digital circuits have never shared. It's not "just" a matter of increasing density or clock rates.
snakeanus 9y ago
> I think it's crazy that we're considering "settling" for a 128-bit hash function Actually the sponge capacity in the so called 128-bit keccak functions is 256, they only call them 128-bit because they provide 128bits of preimage and collision resistance (at 256 bits of output). In a quantum setting the difficulty for preimage and collision attacks for these functions is 2^(256/3), when assuming that the output is of at least 256 bits. > What we should be talking about now is quantum-resistant algorithms that are likely to be even slower than SHA-3 SHA3-256 has c = 512 and output of 256 bits (128 bits of preimage resistance and ~85 bits of collision resistance on a quantum setting), while SHA3-512 has c = 1024 and output of 512 bits (256 bits of preimage resistance and ~170 bits of collision resistance on a quantum setting). I would say that both of the above sha3 versions are quantum resistant. Most modern symmetric cryptography would safe in a post-quantum world, I would say that the only thing that is left is to adopt post-quantum asymmetric algorithms more widely.
- baby 9y ago
  > they only call them 128-bit because they provide 128bits of preimage and collision resistance (at 256 bits of output). You're right, Appendix A.1 of http://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.202.pdf http://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.202.pdf

by mtgx 9y ago

johncolanduoni 9y ago

Quantum computers are pretty unlikely to follow anything like Moore's law. They are fundamentally difficult to scale up due to decoherence and compounding of errors, a property that digital circuits have never shared. It's not "just" a matter of increasing density or clock rates.

snakeanus 9y ago

> I think it's crazy that we're considering "settling" for a 128-bit hash function Actually the sponge capacity in the so called 128-bit keccak functions is 256, they only call them 128-bit because they provide 128bits of preimage and collision resistance (at 256 bits of output). In a quantum setting the difficulty for preimage and collision attacks for these functions is 2^(256/3), when assuming that the output is of at least 256 bits. > What we should be talking about now is quantum-resistant algorithms that are likely to be even slower than SHA-3 SHA3-256 has c = 512 and output of 256 bits (128 bits of preimage resistance and ~85 bits of collision resistance on a quantum setting), while SHA3-512 has c = 1024 and output of 512 bits (256 bits of preimage resistance and ~170 bits of collision resistance on a quantum setting). I would say that both of the above sha3 versions are quantum resistant. Most modern symmetric cryptography would safe in a post-quantum world, I would say that the only thing that is left is to adopt post-quantum asymmetric algorithms more widely.

baby 9y ago
> they only call them 128-bit because they provide 128bits of preimage and collision resistance (at 256 bits of output). You're right, Appendix A.1 of http://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.202.pdf http://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.202.pdf