4 ms·

Makes sense. There would probably need to be a kind of intellectual hoarding and misdirection amongst leading academics in quantum computing research. Yet one w

Makes sense. There would probably need to be a kind of intellectual hoarding and misdirection amongst leading academics in quantum computing research. Yet one would have to assume such research does take place in private by governments. Does signal use the quantum-proof variety of encryption?

cyphar 7y ago
The problem is that the largest QCs that we know of in the public are so ridiculously weak that I find it incredibly improbable that any government is anywhere close to having large enough QCs to break anything. The largest QCs are on the order of tens of qubits, but in order to run Shor's algorithm (to break RSA, or the discrete-log equivalent to break Diffie-Hellman) you need hundreds or thousands of stable qubits -- and the current generation of qubits are unstable. You can make stable qubits out of unstable ones by using error correction, but that requires you to have ~1000 unstable qubits to make one stable qubit. So there's at least 5-6 orders of magnitude separating the current state-of-the-art and when classic public-key crypto will be broken. > Does signal use the quantum-proof variety of encryption? No, there is currently no trusted post-quantum encryption (though the real issue is finding a replacement for public-key crypto because that seems to be the weakest link where quantum computers appear to have the most power). It's being worked on but is a very new field. In addition most post-quantum systems require keys that are kilobytes or even gigabytes in size (elliptic curve keys are tens of bytes). djb (a very well-known cryptographer) and his colleagues give quite a few talks about this[1]. Funnily enough it appears that elliptic curves (which are harder for classic computers to break, and can be easier for classic computers to compute safely) are actually easier for QCs to break because the key sizes are so much smaller (meaning that fewer qubits are required). [1]: https://www.youtube.com/watch?v=ZCmnQR3_qWg https://www.youtube.com/watch?v=ZCmnQR3_qWg
krastanov 7y ago
No, nobody uses quantum-proof encryption yet (usually called post-quantum encryption). Google and others have experimented with it for https and it worked fine, but nothing is deployed yet and standardization has barely began. So if someone records your traffic today, they will be able to decrypt it in a couple of decades.
- cyphar 7y ago
  > Google and others have experimented with it for https and it worked fine To be clear, Google didn't experiment with actually using post-quantum crypto. Their experiment was to figure out what was the largest key sizes that browsers and networks would accept before you start degrading connections. Their "post-quantum keys" were just padding bytes. This was gone through in the Bernstein and Lange talk this year at 35C3[1]. This is a good thing, given the history of the security of post-quantum candidates[2]. [1]: https://youtu.be/ZCmnQR3_qWg?t=1457 https://youtu.be/ZCmnQR3_qWg?t=1457 [2]: https://youtu.be/ZCmnQR3_qWg?t=208 https://youtu.be/ZCmnQR3_qWg?t=208

cyphar 7y ago

The problem is that the largest QCs that we know of in the public are so ridiculously weak that I find it incredibly improbable that any government is anywhere close to having large enough QCs to break anything. The largest QCs are on the order of tens of qubits, but in order to run Shor's algorithm (to break RSA, or the discrete-log equivalent to break Diffie-Hellman) you need hundreds or thousands of stable qubits -- and the current generation of qubits are unstable. You can make stable qubits out of unstable ones by using error correction, but that requires you to have ~1000 unstable qubits to make one stable qubit. So there's at least 5-6 orders of magnitude separating the current state-of-the-art and when classic public-key crypto will be broken. > Does signal use the quantum-proof variety of encryption? No, there is currently no trusted post-quantum encryption (though the real issue is finding a replacement for public-key crypto because that seems to be the weakest link where quantum computers appear to have the most power). It's being worked on but is a very new field. In addition most post-quantum systems require keys that are kilobytes or even gigabytes in size (elliptic curve keys are tens of bytes). djb (a very well-known cryptographer) and his colleagues give quite a few talks about this[1]. Funnily enough it appears that elliptic curves (which are harder for classic computers to break, and can be easier for classic computers to compute safely) are actually easier for QCs to break because the key sizes are so much smaller (meaning that fewer qubits are required). [1]: https://www.youtube.com/watch?v=ZCmnQR3_qWg https://www.youtube.com/watch?v=ZCmnQR3_qWg

krastanov 7y ago

No, nobody uses quantum-proof encryption yet (usually called post-quantum encryption). Google and others have experimented with it for https and it worked fine, but nothing is deployed yet and standardization has barely began. So if someone records your traffic today, they will be able to decrypt it in a couple of decades.

cyphar 7y ago
> Google and others have experimented with it for https and it worked fine To be clear, Google didn't experiment with actually using post-quantum crypto. Their experiment was to figure out what was the largest key sizes that browsers and networks would accept before you start degrading connections. Their "post-quantum keys" were just padding bytes. This was gone through in the Bernstein and Lange talk this year at 35C3[1]. This is a good thing, given the history of the security of post-quantum candidates[2]. [1]: https://youtu.be/ZCmnQR3_qWg?t=1457 https://youtu.be/ZCmnQR3_qWg?t=1457 [2]: https://youtu.be/ZCmnQR3_qWg?t=208 https://youtu.be/ZCmnQR3_qWg?t=208