4 ms·

I hope it makes it through the selection. Either way i'll be using it.

tialaramex 6y ago
What application do you have where huge public keys are no problem, but you fear imminent (at least within a lifetime where you can't upgrade) availability of large quantum computers capable of Shor's algorithm?
- oconnore 6y ago
  How about a web browser? The Nytimes.com front page is 4.66 MB. A Quantum McEliece key is 8373911 bits (per wikipedia) or almost exactly 1MB. Therefore if my connection to Nytimes.com was over McEliece based TLS -- it would be a 21% bandwidth increase. I doubt I would notice.
  - fsociety 6y ago
    You have to consider that web browsers run on IoT devices now and shouldn’t be excluded from security.
    - dependenttypes 6y ago
      I honestly doubt that an IoT device capable of displaying a modern fancy site and running bloated things like webkit would have trouble using Classic McEliece.
  - bawolff 6y ago
    How much of that do you have to download before browser does first paint? With a key handshake you would have to do it before any content is displayed. In much of the modern web (for people blessed with fast connections) latency is much more important than bandwidth. An extra 1mb right upfront might be very different from an extra mb overall. Especially when tcp slow start is taken into account. Even more so if the webpage is loading stuff from many different domains
- dependenttypes 6y ago
  Pretty much anything really. HTTPS, private communications, etc. I am using a computer, not an IoT device.
  - nabla9 6y ago
    Classic McEliece is not good for HTTPS or anything where you need to download new public keys frequently.
    - dependenttypes 6y ago
      You do not need to download a new public key in HTTPS frequently (except if you use forward secrecy, in which case a mixed scheme could be used), most people visit only just a few specific sites. In addition public keys could be cached. Anyway, a lot of web pages are already much bigger than the McEliece public key.
- est31 6y ago
  > imminent The arrival of quantum computers doesn't have to be imminent for it to cause harm. The Utah datacenter (and likely others) store giant amounts of encrypted content, waiting for the key exchange to become decryptable. Currently almost all communication we consider to be encrypted is not safe from quantum computers. How great would it be in 30 years if you had great evidence that people who are in the prime of their careers have done embarrassing things in their youth. You could extort them or use it to get them out of the way if they turn out to be a problem. The value of such information in fact increases over time as those people rise to more important positions of society. So ideally, we'd switch to quantum confidential key exchange as soon as possible so that such an attack can't be done.
  - tialaramex 6y ago
    > How great would it be in 30 years if you had great evidence that people who are in the prime of their careers have done embarrassing things in their youth. Yes, Facebook does exist. I've written about this before. People who don't have a past with vaguely embarrassing things they did and goofy photos and the wrong friends and so on are not future politicians, they are ghosts and their future is as foreign intelligence agents. Do you know what sank Prime Minister "Call me Dave" Cameron in the United Kingdom? Was it the unverified and likely fictitious stories about a pig - similar to events from a popular a TV show? The family tax scandal? Something he did at school or as a young man? Photographs of him dressed like someone from a different century? Nope. What sank Dave was assuming that voters wouldn't destroy their own country to spite people they don't like (including him). A depressingly ordinary political tale, that could come from any era in history.
    - Google234 6y ago
      Wow, that story is really irrelevant. Take the time to read about cancel culture.
- drummer 6y ago
  With Classic McElice, at least right now, the computation time for a keypair is a bigger problem than the size of the public key. It will get faster with better implementations and hardware use. But now it takes many seconds on a Ryzen 9 3950 to generate a keypair. I had to build a system with background threads computing keys and having them ready for quick response when a connection is made. If anyone is interested see: https://github.com/kareldonk/QuantumGate https://github.com/kareldonk/QuantumGate
  - dependenttypes 6y ago
    You might want to check out https://groups.google.com/a/list.nist.gov/forum/#!topic/pqc-forum/koZWqTM714A https://groups.google.com/a/list.nist.gov/forum/#!topic/pqc-... This project that you linked seems quite nice. I especically like its Code of Conduct.
    - drummer 6y ago
      Thanks for the link. It seems the implementations are already improving. From the posted benchmarks it looks like it got twice as fast, which is still slow for some use cases (like ephemeral use for forward secrecy) and slower devices. The best solution will be hardware support.

What application do you have where huge public keys are no problem, but you fear imminent (at least within a lifetime where you can't upgrade) availability of large quantum computers capable of Shor's algorithm?

oconnore 6y ago
How about a web browser? The Nytimes.com front page is 4.66 MB. A Quantum McEliece key is 8373911 bits (per wikipedia) or almost exactly 1MB. Therefore if my connection to Nytimes.com was over McEliece based TLS -- it would be a 21% bandwidth increase. I doubt I would notice.
- fsociety 6y ago
  You have to consider that web browsers run on IoT devices now and shouldn’t be excluded from security.
  - dependenttypes 6y ago
    I honestly doubt that an IoT device capable of displaying a modern fancy site and running bloated things like webkit would have trouble using Classic McEliece.
- bawolff 6y ago
  How much of that do you have to download before browser does first paint? With a key handshake you would have to do it before any content is displayed. In much of the modern web (for people blessed with fast connections) latency is much more important than bandwidth. An extra 1mb right upfront might be very different from an extra mb overall. Especially when tcp slow start is taken into account. Even more so if the webpage is loading stuff from many different domains
dependenttypes 6y ago
Pretty much anything really. HTTPS, private communications, etc. I am using a computer, not an IoT device.
- nabla9 6y ago
  Classic McEliece is not good for HTTPS or anything where you need to download new public keys frequently.
  - dependenttypes 6y ago
    You do not need to download a new public key in HTTPS frequently (except if you use forward secrecy, in which case a mixed scheme could be used), most people visit only just a few specific sites. In addition public keys could be cached. Anyway, a lot of web pages are already much bigger than the McEliece public key.
est31 6y ago
> imminent The arrival of quantum computers doesn't have to be imminent for it to cause harm. The Utah datacenter (and likely others) store giant amounts of encrypted content, waiting for the key exchange to become decryptable. Currently almost all communication we consider to be encrypted is not safe from quantum computers. How great would it be in 30 years if you had great evidence that people who are in the prime of their careers have done embarrassing things in their youth. You could extort them or use it to get them out of the way if they turn out to be a problem. The value of such information in fact increases over time as those people rise to more important positions of society. So ideally, we'd switch to quantum confidential key exchange as soon as possible so that such an attack can't be done.
- tialaramex 6y ago
  > How great would it be in 30 years if you had great evidence that people who are in the prime of their careers have done embarrassing things in their youth. Yes, Facebook does exist. I've written about this before. People who don't have a past with vaguely embarrassing things they did and goofy photos and the wrong friends and so on are not future politicians, they are ghosts and their future is as foreign intelligence agents. Do you know what sank Prime Minister "Call me Dave" Cameron in the United Kingdom? Was it the unverified and likely fictitious stories about a pig - similar to events from a popular a TV show? The family tax scandal? Something he did at school or as a young man? Photographs of him dressed like someone from a different century? Nope. What sank Dave was assuming that voters wouldn't destroy their own country to spite people they don't like (including him). A depressingly ordinary political tale, that could come from any era in history.
  - Google234 6y ago
    Wow, that story is really irrelevant. Take the time to read about cancel culture.
drummer 6y ago
With Classic McElice, at least right now, the computation time for a keypair is a bigger problem than the size of the public key. It will get faster with better implementations and hardware use. But now it takes many seconds on a Ryzen 9 3950 to generate a keypair. I had to build a system with background threads computing keys and having them ready for quick response when a connection is made. If anyone is interested see: https://github.com/kareldonk/QuantumGate https://github.com/kareldonk/QuantumGate
- dependenttypes 6y ago
  You might want to check out https://groups.google.com/a/list.nist.gov/forum/#!topic/pqc-forum/koZWqTM714A https://groups.google.com/a/list.nist.gov/forum/#!topic/pqc-... This project that you linked seems quite nice. I especically like its Code of Conduct.
  - drummer 6y ago
    Thanks for the link. It seems the implementations are already improving. From the posted benchmarks it looks like it got twice as fast, which is still slow for some use cases (like ephemeral use for forward secrecy) and slower devices. The best solution will be hardware support.