3 ms·
Ah, no worries. Post-quantum cryptography has a reputation for being somewhat excessively theoretical (which to be fair is a reasonable argument). But there are
by dsacco 9y ago
Ah, no worries. Post-quantum cryptography has a reputation for being somewhat excessively theoretical (which to be fair is a reasonable argument). But there are benefits other than post-quantum security. For example, lattice problems can provide security according to worst-case hardness, whereas factoring problems can only provide average-case hardness.
In other words, for some lattice problems, we can prove that breaking the cryptosystem is equivalent to breaking every instance of the lattice problem, but factoring problems only guarantee that breaking the cryptosystem is equivalent to breaking a subset of problems from some distibution. The former is a much stronger security assumption (though in practice this comes with its own set of challenges).
It’s an exciting area of research.