4 ms·

How long until one or more of USA/China/Russia has a device to crack such e2e encryption? Secret quantum computer, perhaps?

debatem1 7y ago
Anything that forces adversaries to have novel (let alone sci-fi) technology instead of a warrant is a huge win. Let's not let the perfect be the enemy of the good.
krastanov 7y ago
It would be incredibly surprising for such a device to be created in secret. Moreover, there are versions of public key encryption that can not be broken by a quantum computer.
- isnetea 7y ago
  Makes sense. There would probably need to be a kind of intellectual hoarding and misdirection amongst leading academics in quantum computing research. Yet one would have to assume such research does take place in private by governments. Does signal use the quantum-proof variety of encryption?
  - cyphar 7y ago
    The problem is that the largest QCs that we know of in the public are so ridiculously weak that I find it incredibly improbable that any government is anywhere close to having large enough QCs to break anything. The largest QCs are on the order of tens of qubits, but in order to run Shor's algorithm (to break RSA, or the discrete-log equivalent to break Diffie-Hellman) you need hundreds or thousands of stable qubits -- and the current generation of qubits are unstable. You can make stable qubits out of unstable ones by using error correction, but that requires you to have ~1000 unstable qubits to make one stable qubit. So there's at least 5-6 orders of magnitude separating the current state-of-the-art and when classic public-key crypto will be broken. > Does signal use the quantum-proof variety of encryption? No, there is currently no trusted post-quantum encryption (though the real issue is finding a replacement for public-key crypto because that seems to be the weakest link where quantum computers appear to have the most power). It's being worked on but is a very new field. In addition most post-quantum systems require keys that are kilobytes or even gigabytes in size (elliptic curve keys are tens of bytes). djb (a very well-known cryptographer) and his colleagues give quite a few talks about this[1]. Funnily enough it appears that elliptic curves (which are harder for classic computers to break, and can be easier for classic computers to compute safely) are actually easier for QCs to break because the key sizes are so much smaller (meaning that fewer qubits are required). [1]: https://www.youtube.com/watch?v=ZCmnQR3_qWg https://www.youtube.com/watch?v=ZCmnQR3_qWg
  - krastanov 7y ago
    No, nobody uses quantum-proof encryption yet (usually called post-quantum encryption). Google and others have experimented with it for https and it worked fine, but nothing is deployed yet and standardization has barely began. So if someone records your traffic today, they will be able to decrypt it in a couple of decades.
    - cyphar 7y ago
      > Google and others have experimented with it for https and it worked fine To be clear, Google didn't experiment with actually using post-quantum crypto. Their experiment was to figure out what was the largest key sizes that browsers and networks would accept before you start degrading connections. Their "post-quantum keys" were just padding bytes. This was gone through in the Bernstein and Lange talk this year at 35C3[1]. This is a good thing, given the history of the security of post-quantum candidates[2]. [1]: https://youtu.be/ZCmnQR3_qWg?t=1457 https://youtu.be/ZCmnQR3_qWg?t=1457 [2]: https://youtu.be/ZCmnQR3_qWg?t=208 https://youtu.be/ZCmnQR3_qWg?t=208
alexnewman 7y ago
Or just maybe they should send you a different app on the app store
- isnetea 7y ago
  One of many attack vectors. Weaken the encryption, backdoor the encryption. Secret flaws in plain sight in the app.
isnetea 7y ago
Sorry, I must have left out private entities, which led to downvotes. Snowden is likely to have caused an exodus of hoarded intent of knowledge towards private global interests, away from governments. So the quantum race, then, would be going on behind the scenes with both private and public interests. How hard will it be to switch to post quantum encryption globally once it’s clear publicly that there’s at least a proof of concept for a quantum decryption supercomputer? How do you differentiate between cloned 210 iq babies in massive underground communities (as an example) working on decades in the future tech, and safeguards amongst the destructive forces of the powerful hegemonic incumbency. There’s an applicable abstraction here, generally, about containing superior intelligence, whether artificial or biological. I do believe recent Star Trek movie touched upon this
- cyphar 7y ago
  > How hard will it be to switch to post quantum encryption globally once it’s clear publicly that there’s at least a proof of concept for a quantum decryption supercomputer? In theory switching could be "simple" but depends very strongly on what post-quantum algorithms we end up with. If we have a good replacement for Diffie-Hellman (the current candidate appears to CSIDH[1]) then you could replace effectively everything with it because the protocols could be left unchanged. The keys might be a bit larger but who cares. However, if there is no safe Diffie-Hellman replacement then we'll need to change our protocols to accommodate the new crypto. Symmetric-key crypto appears to be mostly safe (Grover's Algorithm can only provide a square-root improvement and so we can just double our key sizes to 256 or 512 bit) so we only need to fix the public-key part, and can work on replacing the rest later. [1]: https://csidh.isogeny.org/ https://csidh.isogeny.org/

debatem1 7y ago

Anything that forces adversaries to have novel (let alone sci-fi) technology instead of a warrant is a huge win. Let's not let the perfect be the enemy of the good.

krastanov 7y ago

It would be incredibly surprising for such a device to be created in secret. Moreover, there are versions of public key encryption that can not be broken by a quantum computer.

isnetea 7y ago
Makes sense. There would probably need to be a kind of intellectual hoarding and misdirection amongst leading academics in quantum computing research. Yet one would have to assume such research does take place in private by governments. Does signal use the quantum-proof variety of encryption?
- cyphar 7y ago
  The problem is that the largest QCs that we know of in the public are so ridiculously weak that I find it incredibly improbable that any government is anywhere close to having large enough QCs to break anything. The largest QCs are on the order of tens of qubits, but in order to run Shor's algorithm (to break RSA, or the discrete-log equivalent to break Diffie-Hellman) you need hundreds or thousands of stable qubits -- and the current generation of qubits are unstable. You can make stable qubits out of unstable ones by using error correction, but that requires you to have ~1000 unstable qubits to make one stable qubit. So there's at least 5-6 orders of magnitude separating the current state-of-the-art and when classic public-key crypto will be broken. > Does signal use the quantum-proof variety of encryption? No, there is currently no trusted post-quantum encryption (though the real issue is finding a replacement for public-key crypto because that seems to be the weakest link where quantum computers appear to have the most power). It's being worked on but is a very new field. In addition most post-quantum systems require keys that are kilobytes or even gigabytes in size (elliptic curve keys are tens of bytes). djb (a very well-known cryptographer) and his colleagues give quite a few talks about this[1]. Funnily enough it appears that elliptic curves (which are harder for classic computers to break, and can be easier for classic computers to compute safely) are actually easier for QCs to break because the key sizes are so much smaller (meaning that fewer qubits are required). [1]: https://www.youtube.com/watch?v=ZCmnQR3_qWg https://www.youtube.com/watch?v=ZCmnQR3_qWg
- krastanov 7y ago
  No, nobody uses quantum-proof encryption yet (usually called post-quantum encryption). Google and others have experimented with it for https and it worked fine, but nothing is deployed yet and standardization has barely began. So if someone records your traffic today, they will be able to decrypt it in a couple of decades.
  - cyphar 7y ago
    > Google and others have experimented with it for https and it worked fine To be clear, Google didn't experiment with actually using post-quantum crypto. Their experiment was to figure out what was the largest key sizes that browsers and networks would accept before you start degrading connections. Their "post-quantum keys" were just padding bytes. This was gone through in the Bernstein and Lange talk this year at 35C3[1]. This is a good thing, given the history of the security of post-quantum candidates[2]. [1]: https://youtu.be/ZCmnQR3_qWg?t=1457 https://youtu.be/ZCmnQR3_qWg?t=1457 [2]: https://youtu.be/ZCmnQR3_qWg?t=208 https://youtu.be/ZCmnQR3_qWg?t=208

alexnewman 7y ago

Or just maybe they should send you a different app on the app store

isnetea 7y ago
One of many attack vectors. Weaken the encryption, backdoor the encryption. Secret flaws in plain sight in the app.

isnetea 7y ago

Sorry, I must have left out private entities, which led to downvotes. Snowden is likely to have caused an exodus of hoarded intent of knowledge towards private global interests, away from governments. So the quantum race, then, would be going on behind the scenes with both private and public interests. How hard will it be to switch to post quantum encryption globally once it’s clear publicly that there’s at least a proof of concept for a quantum decryption supercomputer? How do you differentiate between cloned 210 iq babies in massive underground communities (as an example) working on decades in the future tech, and safeguards amongst the destructive forces of the powerful hegemonic incumbency. There’s an applicable abstraction here, generally, about containing superior intelligence, whether artificial or biological. I do believe recent Star Trek movie touched upon this

cyphar 7y ago
> How hard will it be to switch to post quantum encryption globally once it’s clear publicly that there’s at least a proof of concept for a quantum decryption supercomputer? In theory switching could be "simple" but depends very strongly on what post-quantum algorithms we end up with. If we have a good replacement for Diffie-Hellman (the current candidate appears to CSIDH[1]) then you could replace effectively everything with it because the protocols could be left unchanged. The keys might be a bit larger but who cares. However, if there is no safe Diffie-Hellman replacement then we'll need to change our protocols to accommodate the new crypto. Symmetric-key crypto appears to be mostly safe (Grover's Algorithm can only provide a square-root improvement and so we can just double our key sizes to 256 or 512 bit) so we only need to fix the public-key part, and can work on replacing the rest later. [1]: https://csidh.isogeny.org/ https://csidh.isogeny.org/