5 ms·
I want to critique one particular point made in this article, becuase it’s incorrect: > IOTA uses cryptography that cannot be broken by quantum computers. The
by dsacco 9y ago
I want to critique one particular point made in this article, becuase it’s incorrect:
> IOTA uses cryptography that cannot be broken by quantum computers. The use of such cryptography, specifically Winternitz signatures, leaves IOTA users vulnerable to loss of funds if they ever reuse an address. This attack that has already been seen in practice, with one user reportedly losing $30,000 USD worth of IOTA.
As quantum computers large enough to threaten existing cryptosystems do not exist and may not exist for many decades, this use of post quantum cryptography comes with no tangible benefit.
“No tangible benefit” is a gross overstatement and simplification. I wholeheartedly agree that 1) novel cryptography should not be adopted before it has been well-studied, and 2) threat models for motivating novel cryptography should be rational and pass a cost-benefit analysis. However, if and when quantum computers can practically break classical cryptosystems, they will be able to do against everything cryptography is used to secure today, not just going forwards. This is a stonger argument for encryption and confidentiality, but it nevertheless also applies to signatures and authentication. As a tangential point: while they aren’t perfect (in terms of efficiency), Winternitz signatures are very well studied. Given what’s available, it’s not a bad choice.
I think a lot of IOTA’s specification is pretty suspect, especially since it does utilize novel cryptography without an apparent track record or notable expertise among its team. But I also absolutely believe new cryptocurrencies and blockchain projects should be preparing for quantum computation now, if it’s possible. More pertinently, I don’t agree with the way this point was presented, because it can be interpreted as the claim that post-quantum cryptography is a useful heuristic in determining if a project has “issues”. In reality all cryptography should be suspect, and the use of post-quantum cryptography should not be dismissed immediately as a waste. With IOTA in particular, I’m weakly on the side that they shouldn’t have bothered with Winternitz signatures. But in general, I’m happy to see any project at least giving it serious consideration.
- simias 9y agoDon't you think IOTA is trying to do too much at the same time? Maybe I'm underestimating the risk but it seems like practical quantum computer attacks are still a few decades away, maybe it would make more sense to focus on getting the rest of IOTA to work and plan to switch to different cryptographic algorithms later once things have settled a bit. If I get this right IOTA is trying to: * Move away from PoW * Have a cryptocurrency that scales well to a very high transaction frequency * Implement quantum-resistant cryptography * Use ternary logic to theoretically minimize power consumption That's a lot for a single project I think.
- dsacco 9y agoRight, so there’s the problem. I consider post-quantum cryotography to be more important than everything else on that list aside from transaction frequency. It should be, at the least, a serious consideration for any new cryptocurrency, even if they don’t ultimately move forward with it after a cost-benefit analysis. The threat model is more nuanced than “decades away.” The attacks may be decades away, but their targets will not necessarily be. Assets and communications secured today will be fully seizable and transparent in the future, you just don’t know exactly when. In other words, old ciphertexts have to be disposed of or re-encrypted, and addresses need to upgrade to pq-secure signature schemes. This all takes for granted the idea that quantum computers will ever feasibly break classical cryptosystems (I’m weakly pessimistic it will happen in the next 100 years). But if you do accept that premise, you either implement post-quantum cryptography now if you can afford it, or you implement it on top of legacy software in the indeterminate future. The latter option is a legitimate decision, to be clear. But I can also virtually guarantee that some cryptocurrencies will footgun themselves in the process of upgrading when they’re more established. I agree with you that IOTA is taking on a lot, but I really don’t think Winternitz signatures are exactly the deciding factor in that, based on how packed that list is already :)
- rodarmor 9y agoI think that switch commitments are an interesting way to go: https://lists.launchpad.net/mimblewimble/msg00195.html https://lists.launchpad.net/mimblewimble/msg00195.html They let you fork in post-quantum cryptography at a later date, assume that there isn't a sudden and unexpected breakthrough in the capabilities of quantum computers.
- jgh 9y agoThis seems to be the case with a lot of cryptocurrencies. They spread themselves too thin before they've even begun solving the core problems they need to solve. It would be enough to get a DAG-based distributed ledger/coin running and running well, but throw in all the extra nonsense and it's just a mess of poor prioritization.
- solotronics 9y agoI am somewhat of a layman in regards to the math of cryptography but could you solve this by using Winternitz signatures first then something like chacha?
- dsacco 9y agoI’m a little unclear as to what you mean. Winternitz (W-OTS) is a hash-based digital signature scheme. ChaCha is a stream cipher for symmetric encryption. Do you mean a Winternitz signature digest encrypted with ChaCha, or are you proposing a ChaCha derivative hash function, like Blake? In either case, I don’t see what it gets you to use the post-quantum signatures anyway, then add the overhead of ChaCha.
- rodarmor 9y agoI intend for the phrase "no tangible benefit" to mean "at the current time", since large quantum computers do not yet exist. Now, it's possible that this benefit will be made tangible eventually, should large quantum computers become practical, but they just aren't here yet.