4 ms·

Half the Internet is now protected by djb's secure, robust, practical, high-performance algorithms (Curve25519, Ed25519, ChaCha20, Poly1305), it's not an overst

Half the Internet is now protected by djb's secure, robust, practical, high-performance algorithms (Curve25519, Ed25519, ChaCha20, Poly1305), it's not an overstatement, and it's a decisive victory in the Crypto War. What I'm worrying now is the post-quantum future. You see, elliptic curve cryptography was introduced around 1999 (NIST curves), but it took 10 years to have a robust, secure, and practical algorithm developed (Curve25519) in 2007, and another 10 years for tho public to accept and deploy it in major systems in 2017. [0] And now the threat of quantum computers is getting closer and closer, cryptographers are well-aware of that, post-quantum cryptography is a huge area of research nowadays (just follow the NIST competition). If the past history repeats, it would mean that we'll have some usable post-quantum public key algorithms soon, which will be secure in a theoretical sense, but with huge number of pitfalls in practical systems, and it will take another 20 years to deploy something really secure and robust in a practical sense. And all the horrible stories of weak crypto, all the vulnerabilities, and NSA, etc, will repeats again in the next two or three decades! [0] I'm not advertising for djb, if it's not him, there will be something else as well, but the point is...

lifthrasiir 7y ago
At the very least, djb and others are working on post-quantum cryptography [1]. [1] https://pqcrypto.org/ https://pqcrypto.org/
- MrXOR 7y ago
  He was a pioneer in this field. he introduces this term in 2003.
- chasil 7y ago
  TinySSH has introduced a combination of NTRU with 25519. https://tinyssh.org/ https://tinyssh.org/ "Postquantum crypto: sntrup4591761x25519-sha512@tinyssh.org" OpenSSH included this as an experimental feature in v8: https://www.openssh.com/releasenotes.html https://www.openssh.com/releasenotes.html " * ssh(1), sshd(8): Add experimental quantum-computing resistant key exchange method, based on a combination of Streamlined NTRU Prime 4591^761 and X25519." The TinySSH implementation is on github: https://github.com/janmojzis/tinyssh/blob/master/PROTOCOL.sntrup4591761x25519-sha512 https://github.com/janmojzis/tinyssh/blob/master/PROTOCOL.sn...
rkangel 7y ago
> and another 10 years for the public to accept and deploy it in major systems in 2017 This was possibly due to not seeing the need. The press that Quantum Computing is getting (e.g. recent Google publication) will likely raise the public consciousness of the future risks. This will make post-quantum algorithms a selling point and so will help adoption.
pnako 7y ago
How much of this stuff was validated through public competitions like for AES, etc.? I have no doubt he's a stellar cryptographer but it looks to me like there is also some fanboyism from programmers with no particular crypto background.
- pingyong 7y ago
  All of the algorithms are considered secure by the cryptographic community. You don't have to win a NIST competition to be considered secure, most if not all of the AES competition finalists that didn't win are also still unbroken. (Although some have been more thoroughly analyzed than others over the years.)
- hannob 7y ago
  > How much of this stuff was validated through public competitions like for AES, etc.? Some of it, with some caveats. Salsa20 was a result of the estream competition. This was organized in a similar fashion to the AES competition, although it didn't get nearly as much attention. Chacha20 is only a slight variation of salsa20. Curve25519 was discussed extensively in the IETF. It wasn't a formal competition, but it was an extensive discussion and there was definitely motivation from others to point out any issues that there might be with curve25519.
- dangerface 7y ago
  > How much of this stuff was validated through public competitions like for AES, etc.? Curve25519, Ed25519, ChaCha20, Poly1305 have all been entered into competitions like AES and usually get to the final round which is usually more about politics than security. The algorithms have also been validated by independents like google who where one of the first to review, use and promote the algorithms. > it looks to me like there is also some fanboyism from programmers with no particular crypto background. Absolutely but we fan boy for him because he has been so widely reviewed with stellar results.
  - floodyberry- 7y ago
    None of them have been in any competition like AES
pingyong 7y ago
We have had something "theoretically secure" for like 40 years now, current research is more about how to make those ideas usable in practice (and ideally stateless), so I don't share your pessimism here. Those ideas are also fundamentally based on symmetric algorithms, which are already well understood. I would expect the transition to be fairly easy honestly (once a standard has been decently established), except for systems that are very constrained in storage/bandwidth, since either the keys or the signatures are going to become quite a lot larger.
MrXOR 7y ago
But, I'm advertising for him: djb's tools and standards are better than NIST's standards. he is my DIST!
floodyberry- 7y ago
ECC was introduced in 1985, Curve25519 in 2005, and Edwards Curves in 2007 Post-quantum public key algorithms have existed for a while, e.g. https://en.wikipedia.org/wiki/McEliece_cryptosystem https://en.wikipedia.org/wiki/McEliece_cryptosystem (1978) and https://en.wikipedia.org/wiki/NTRU https://en.wikipedia.org/wiki/NTRU (1996), the issue is settling on one that has acceptable performance and key lengths

lifthrasiir 7y ago

At the very least, djb and others are working on post-quantum cryptography [1]. [1] https://pqcrypto.org/ https://pqcrypto.org/

MrXOR 7y ago
He was a pioneer in this field. he introduces this term in 2003.
chasil 7y ago
TinySSH has introduced a combination of NTRU with 25519. https://tinyssh.org/ https://tinyssh.org/ "Postquantum crypto: sntrup4591761x25519-sha512@tinyssh.org" OpenSSH included this as an experimental feature in v8: https://www.openssh.com/releasenotes.html https://www.openssh.com/releasenotes.html " * ssh(1), sshd(8): Add experimental quantum-computing resistant key exchange method, based on a combination of Streamlined NTRU Prime 4591^761 and X25519." The TinySSH implementation is on github: https://github.com/janmojzis/tinyssh/blob/master/PROTOCOL.sntrup4591761x25519-sha512 https://github.com/janmojzis/tinyssh/blob/master/PROTOCOL.sn...

rkangel 7y ago

> and another 10 years for the public to accept and deploy it in major systems in 2017 This was possibly due to not seeing the need. The press that Quantum Computing is getting (e.g. recent Google publication) will likely raise the public consciousness of the future risks. This will make post-quantum algorithms a selling point and so will help adoption.

pnako 7y ago

How much of this stuff was validated through public competitions like for AES, etc.? I have no doubt he's a stellar cryptographer but it looks to me like there is also some fanboyism from programmers with no particular crypto background.

pingyong 7y ago
All of the algorithms are considered secure by the cryptographic community. You don't have to win a NIST competition to be considered secure, most if not all of the AES competition finalists that didn't win are also still unbroken. (Although some have been more thoroughly analyzed than others over the years.)
hannob 7y ago
> How much of this stuff was validated through public competitions like for AES, etc.? Some of it, with some caveats. Salsa20 was a result of the estream competition. This was organized in a similar fashion to the AES competition, although it didn't get nearly as much attention. Chacha20 is only a slight variation of salsa20. Curve25519 was discussed extensively in the IETF. It wasn't a formal competition, but it was an extensive discussion and there was definitely motivation from others to point out any issues that there might be with curve25519.
dangerface 7y ago
> How much of this stuff was validated through public competitions like for AES, etc.? Curve25519, Ed25519, ChaCha20, Poly1305 have all been entered into competitions like AES and usually get to the final round which is usually more about politics than security. The algorithms have also been validated by independents like google who where one of the first to review, use and promote the algorithms. > it looks to me like there is also some fanboyism from programmers with no particular crypto background. Absolutely but we fan boy for him because he has been so widely reviewed with stellar results.
- floodyberry- 7y ago
  None of them have been in any competition like AES

pingyong 7y ago

We have had something "theoretically secure" for like 40 years now, current research is more about how to make those ideas usable in practice (and ideally stateless), so I don't share your pessimism here. Those ideas are also fundamentally based on symmetric algorithms, which are already well understood. I would expect the transition to be fairly easy honestly (once a standard has been decently established), except for systems that are very constrained in storage/bandwidth, since either the keys or the signatures are going to become quite a lot larger.

MrXOR 7y ago

But, I'm advertising for him: djb's tools and standards are better than NIST's standards. he is my DIST!

floodyberry- 7y ago

ECC was introduced in 1985, Curve25519 in 2005, and Edwards Curves in 2007 Post-quantum public key algorithms have existed for a while, e.g. https://en.wikipedia.org/wiki/McEliece_cryptosystem https://en.wikipedia.org/wiki/McEliece_cryptosystem (1978) and https://en.wikipedia.org/wiki/NTRU https://en.wikipedia.org/wiki/NTRU (1996), the issue is settling on one that has acceptable performance and key lengths