4 ms·

Some ciphers use this method, it’s not the problem. QC isn’t going to break all crypto traditional symmetric ciphers are safe and one of the simplest classical

Some ciphers use this method, it’s not the problem. QC isn’t going to break all crypto traditional symmetric ciphers are safe and one of the simplest classical ciphers a one time pad is still the safest method of encryption when it’s done correctly. QC may break some asymmetric encryption which relies on factoring numbers. Asymmetric encryption is on some level security through obscurity as you publicly display a key from which your encryption key can be mathematically derived and you rely solely on the fact that it’s a very hard thing to do. But as far as classical encryption goes XORing a message against a random number of bits equal to the message length would always be secure, especially for long messages the problem is that it ain’t very practical. That said however we do have QC resistant key exchange and signature algorithms so I don’t think there is that much reason to panic. I’m pretty sure you can still find 1024bit and lower RSA key systems still in use arguably these are less secure today than 2048 and 4096bit RSA keys will be during the first years of a post QC world.

amelius 7y ago
> That said however we do have QC resistant key exchange and signature algorithms so I don’t think there is that much reason to panic. Interesting. Then shouldn't we (and PR people involved in QC) stop focusing on the cryptographical capabilities of QC, and start focusing on its other potential applications, like protein folding? Until now in the media, it seems like QC is synonymous with crypto ...
- wolfgke 7y ago
  > Interesting. Then shouldn't we (and PR people involved in QC) stop focusing on the cryptographical capabilities of QC, and start focusing on its other potential applications, like protein folding? Until now in the media, it seems like QC is synonymous with crypto ... Relevant: > https://en.wikipedia.org/w/index.php?title=Gell-Mann_amnesia_effect&oldid=900197054 https://en.wikipedia.org/w/index.php?title=Gell-Mann_amnesia...
- dogma1138 7y ago
  Well depends on what your threat model is. If it’s criminals stealing your passwords then it would take decades after QC until it would become universal enough to be a problem, by then likely current traffic would not be affected. If it’s state level actors then you might be in a bigger bind. If we take the NSA for example today there isn’t a single cryptographic system they can’t compromise. And I’m using the term system intentionally as the NSA can’t break 4096bit RSA or AES or any other competent cipher. They can and do break cryptographic systems on a daily basis by compromising the hardware, software and people which the system relies on. But this is a very targeted and costly operation which means that general internet traffic isn’t looked at because it’s not worth it. However if they also capture encrypted traffic and store it indefinitely as most key exchanges today are not necessarily QC resistant they could potentially go back and decrypt all that traffic. This is why while the house is not on fire I think there is value in pushing post-QC ciphers sooner rather than later. And even if the NSA can be kept in check we have little control over Russia and China and the list of actors capable of operating at large enough scales for this to be a problem grows bigger every day.
  - faissaloo 7y ago
    Just pointing out that the NSA have had plans to build a quantum computer, not sure where they got with it
    - dogma1138 7y ago
      OFC they will, it would be criminally negligent of them not to. However if the NSA is currently your adversary and you are worried of being targeted then pre QC or post QC encryption isn't going to matter push comes to shove they'll beat it out of you. But as I said if the NSA or any other agency is currently capturing and storing encrypted data they can't afford to decrypt via targeted means they'll be able to retroactively decrypt it if they do manage to build a quantum computer and quantum supremacy would be a definite thing. But right now there isn't an encryption the NSA can't break as long as there are people and additional assets involved in the process. In fact I would be that for targeted attacks it would still bet easier to bribe, raid/hack the server farm or beat the snot out of someone in a black site than to use a quantum computer for quite a while after these things would be become a reality to factor the RSA private key corresponding with the key exchange of the traffic you want to decrypt.
est31 7y ago
> That said however we do have QC resistant key exchange and signature algorithms so I don’t think there is that much reason to panic. We don't have QC resistant key exchange. Not yet. There are a couple of proposals, and there is a competition going on on, but it hasn't concluded yet: https://csrc.nist.gov/Projects/Post-Quantum-Cryptography https://csrc.nist.gov/Projects/Post-Quantum-Cryptography
- dogma1138 7y ago
  Isn’t SIDH which is posed to replace DHE and ECDHE anyhow considered a post quantum cipher?
  - est31 7y ago
    Yeah SIDH/SIKE are some of the stronger proposals in the NIST competition. But for now I'd consider them to be proposals, not something that should be deployed widely.
    - dogma1138 7y ago
      Yeah they haven't been standardised yet and if we want to push back as much as possible on retroactive decryption then we should move faster on standardising and deploying post QC key exchanges but it's not like these are completely flaky, untested and not well understood (I'm sure some of them are tho... which is why NIST competitions and their EU counterparts are important).

amelius 7y ago

> That said however we do have QC resistant key exchange and signature algorithms so I don’t think there is that much reason to panic. Interesting. Then shouldn't we (and PR people involved in QC) stop focusing on the cryptographical capabilities of QC, and start focusing on its other potential applications, like protein folding? Until now in the media, it seems like QC is synonymous with crypto ...

wolfgke 7y ago
> Interesting. Then shouldn't we (and PR people involved in QC) stop focusing on the cryptographical capabilities of QC, and start focusing on its other potential applications, like protein folding? Until now in the media, it seems like QC is synonymous with crypto ... Relevant: > https://en.wikipedia.org/w/index.php?title=Gell-Mann_amnesia_effect&oldid=900197054 https://en.wikipedia.org/w/index.php?title=Gell-Mann_amnesia...
dogma1138 7y ago
Well depends on what your threat model is. If it’s criminals stealing your passwords then it would take decades after QC until it would become universal enough to be a problem, by then likely current traffic would not be affected. If it’s state level actors then you might be in a bigger bind. If we take the NSA for example today there isn’t a single cryptographic system they can’t compromise. And I’m using the term system intentionally as the NSA can’t break 4096bit RSA or AES or any other competent cipher. They can and do break cryptographic systems on a daily basis by compromising the hardware, software and people which the system relies on. But this is a very targeted and costly operation which means that general internet traffic isn’t looked at because it’s not worth it. However if they also capture encrypted traffic and store it indefinitely as most key exchanges today are not necessarily QC resistant they could potentially go back and decrypt all that traffic. This is why while the house is not on fire I think there is value in pushing post-QC ciphers sooner rather than later. And even if the NSA can be kept in check we have little control over Russia and China and the list of actors capable of operating at large enough scales for this to be a problem grows bigger every day.
- faissaloo 7y ago
  Just pointing out that the NSA have had plans to build a quantum computer, not sure where they got with it
  - dogma1138 7y ago
    OFC they will, it would be criminally negligent of them not to. However if the NSA is currently your adversary and you are worried of being targeted then pre QC or post QC encryption isn't going to matter push comes to shove they'll beat it out of you. But as I said if the NSA or any other agency is currently capturing and storing encrypted data they can't afford to decrypt via targeted means they'll be able to retroactively decrypt it if they do manage to build a quantum computer and quantum supremacy would be a definite thing. But right now there isn't an encryption the NSA can't break as long as there are people and additional assets involved in the process. In fact I would be that for targeted attacks it would still bet easier to bribe, raid/hack the server farm or beat the snot out of someone in a black site than to use a quantum computer for quite a while after these things would be become a reality to factor the RSA private key corresponding with the key exchange of the traffic you want to decrypt.

est31 7y ago

> That said however we do have QC resistant key exchange and signature algorithms so I don’t think there is that much reason to panic. We don't have QC resistant key exchange. Not yet. There are a couple of proposals, and there is a competition going on on, but it hasn't concluded yet: https://csrc.nist.gov/Projects/Post-Quantum-Cryptography https://csrc.nist.gov/Projects/Post-Quantum-Cryptography

dogma1138 7y ago
Isn’t SIDH which is posed to replace DHE and ECDHE anyhow considered a post quantum cipher?
- est31 7y ago
  Yeah SIDH/SIKE are some of the stronger proposals in the NIST competition. But for now I'd consider them to be proposals, not something that should be deployed widely.
  - dogma1138 7y ago
    Yeah they haven't been standardised yet and if we want to push back as much as possible on retroactive decryption then we should move faster on standardising and deploying post QC key exchanges but it's not like these are completely flaky, untested and not well understood (I'm sure some of them are tho... which is why NIST competitions and their EU counterparts are important).