4 ms·

No, absolutely not. If quantum computers happen (which is still a big if) then mostly two things will happen: 1. Cryptographers will have to switch many of th

by hannob 7y ago

No, absolutely not. If quantum computers happen (which is still a big if) then mostly two things will happen: 1. Cryptographers will have to switch many of their algorithms and things like TLS will get a bit slower and will need a bit more data transmitted. 2. It's interesting for science, e.g. for simulations. For the regular dev I'm pretty sure it won't have any meaningful impact. Also even if quantum computers happen they won't be on our desks any time soon. It'll probably more like "you can rent a QC for specialized tasks in the cloud, but it will be relatively expensive and if you don't really need one you'll use something else".

deleted 7y ago
[deleted]
ganzuul 7y ago
You should already have switched to AES256 or better. The data can be captured and processed once a machine is available.
- cyphar 7y ago
  The risk with quantum computers is with public-key cryptography (where all modern PK crypto is broken with a sufficiently-powerful quantum computers). It is believed that attacks with a quantum computer against symmetric-key cryptography (like AES) gain no better than a square-root improvement (meaning that doubling key sizes eliminates the risk).
  - ChrisLomont 7y ago
    >where all modern PK crypto is broken with a sufficiently-powerful quantum computers This isn't true - only methods based on Discrete Log are at risk, which includes RSA and ECC, but there are a lot of PK algos that are not at risk, like NTRU. Here's a bunch of stuff related https://en.wikipedia.org/wiki/Post-quantum_cryptography https://en.wikipedia.org/wiki/Post-quantum_cryptography
    - cyphar 7y ago
      PQ-Crypto is still a very young research area. There is no widespread (or even niche) use of PQ-Crypto algorithms, no consensus on how safe any of the proposed algorithms are (and many proposals were found to be exceptionally broken -- on classical hardware -- within weeks of their submission[1]). I'm not really sure it's fair to say that just because there are some on-paper algorithms (which have no usage outside academia at the moment) that might solve the problem that it's false to say that "all modern PK crypto is broken with quantum attackers". But if you prefer, you could imagine that I said "all modern PK crypto [that is actually in use today] is broken". Because, at the end of the day, that's all that really matters. [As an aside, for RSA the security is provided by the hardness of factorisation which also breaks under QC attackers, not discrete log (it's discrete log for DH, and EC discrete log for ECDH).] [1]: https://www.youtube.com/watch?v=ZCmnQR3_qWg https://www.youtube.com/watch?v=ZCmnQR3_qWg
      - sweis 7y ago
        It not exactly a young research area. We have had post-quantum public key cryptosystems based on linear codes for over 40 years. Classic McEliece (https://classic.mceliece.org https://classic.mceliece.org) was created in 1978 and is in the 2nd round of NIST's PQ-crypto contest ( https://csrc.nist.gov/projects/post-quantum-cryptography/round-2-submissions https://csrc.nist.gov/projects/post-quantum-cryptography/rou...). The PQCrypto conference started 13 years ago: https://pqcrypto.org/conferences.html https://pqcrypto.org/conferences.html Chrome ran large scale experiments with NewHope support 3 years ago: https://security.googleblog.com/2016/07/experimenting-with-post-quantum.html https://security.googleblog.com/2016/07/experimenting-with-p...
        deleted 7y ago
        [deleted]
      - ChrisLomont 7y ago
        Shor factoring for RSA works by period finding, which is all modern PK crypto discrete log. Read the wiki page. I wrote a decently cited paper summarizing all this when I worked in quantum computing research around 2005, on arxiv. Track it down if you’re interested. I’ve followed the field for decades, giving talks once in a while on it. So I do know a bit of the details. The computational power of QC is very well studied. It is certain that it cannot crack certain (most) problems any faster than a classical computer. Thus algorithms not isomorphic to the few problems QC is better at are just as secure on both classical and quantum computers. There is consensus on this - there is no question about it. >all modern PK crypto [that is actually in use today] NTRU is an IEEE standard, and is in wolfSSL, which is on many platforms. NTRU is also used in many commercial products from chat to relays. Other non DLP methods are also used in commercial products and standards.
- ccozan 7y ago
  But maybe then is already irrelevant?
- steelframe 7y ago
  > AES256 or better I'm not aware of any symmetric cipher that the industry in broad consensus would consider "better" than AES-256.

by hannob 7y ago

deleted 7y ago

[deleted]

ganzuul 7y ago

You should already have switched to AES256 or better. The data can be captured and processed once a machine is available.

cyphar 7y ago
The risk with quantum computers is with public-key cryptography (where all modern PK crypto is broken with a sufficiently-powerful quantum computers). It is believed that attacks with a quantum computer against symmetric-key cryptography (like AES) gain no better than a square-root improvement (meaning that doubling key sizes eliminates the risk).
- ChrisLomont 7y ago
  >where all modern PK crypto is broken with a sufficiently-powerful quantum computers This isn't true - only methods based on Discrete Log are at risk, which includes RSA and ECC, but there are a lot of PK algos that are not at risk, like NTRU. Here's a bunch of stuff related https://en.wikipedia.org/wiki/Post-quantum_cryptography https://en.wikipedia.org/wiki/Post-quantum_cryptography
  - cyphar 7y ago
    PQ-Crypto is still a very young research area. There is no widespread (or even niche) use of PQ-Crypto algorithms, no consensus on how safe any of the proposed algorithms are (and many proposals were found to be exceptionally broken -- on classical hardware -- within weeks of their submission[1]). I'm not really sure it's fair to say that just because there are some on-paper algorithms (which have no usage outside academia at the moment) that might solve the problem that it's false to say that "all modern PK crypto is broken with quantum attackers". But if you prefer, you could imagine that I said "all modern PK crypto [that is actually in use today] is broken". Because, at the end of the day, that's all that really matters. [As an aside, for RSA the security is provided by the hardness of factorisation which also breaks under QC attackers, not discrete log (it's discrete log for DH, and EC discrete log for ECDH).] [1]: https://www.youtube.com/watch?v=ZCmnQR3_qWg https://www.youtube.com/watch?v=ZCmnQR3_qWg
    - sweis 7y ago
      It not exactly a young research area. We have had post-quantum public key cryptosystems based on linear codes for over 40 years. Classic McEliece (https://classic.mceliece.org https://classic.mceliece.org) was created in 1978 and is in the 2nd round of NIST's PQ-crypto contest ( https://csrc.nist.gov/projects/post-quantum-cryptography/round-2-submissions https://csrc.nist.gov/projects/post-quantum-cryptography/rou...). The PQCrypto conference started 13 years ago: https://pqcrypto.org/conferences.html https://pqcrypto.org/conferences.html Chrome ran large scale experiments with NewHope support 3 years ago: https://security.googleblog.com/2016/07/experimenting-with-post-quantum.html https://security.googleblog.com/2016/07/experimenting-with-p...
      - deleted 7y ago
        [deleted]
    - ChrisLomont 7y ago
      Shor factoring for RSA works by period finding, which is all modern PK crypto discrete log. Read the wiki page. I wrote a decently cited paper summarizing all this when I worked in quantum computing research around 2005, on arxiv. Track it down if you’re interested. I’ve followed the field for decades, giving talks once in a while on it. So I do know a bit of the details. The computational power of QC is very well studied. It is certain that it cannot crack certain (most) problems any faster than a classical computer. Thus algorithms not isomorphic to the few problems QC is better at are just as secure on both classical and quantum computers. There is consensus on this - there is no question about it. >all modern PK crypto [that is actually in use today] NTRU is an IEEE standard, and is in wolfSSL, which is on many platforms. NTRU is also used in many commercial products from chat to relays. Other non DLP methods are also used in commercial products and standards.
ccozan 7y ago
But maybe then is already irrelevant?
steelframe 7y ago
> AES256 or better I'm not aware of any symmetric cipher that the industry in broad consensus would consider "better" than AES-256.