4 ms·

I think the last comment on the article is the most important for discussion. —- KEEP USING RSA! This article is misleading to make it appear that RSA is not

I think the last comment on the article is the most important for discussion. —- KEEP USING RSA! This article is misleading to make it appear that RSA is not secure, but only the only evidence presented is improper implementation. Properly implemented RSA has been proven secure and unbreakable by the NSA with case studies such as Snowden, Lavabit, dark markets, and ECC is much harder to properly implement than RSA. The NSA has been pushing ECC because their quantum chips can break it easily. D-Wave, Google, Alibaba, and others already have quantum chips. The disinformation agents claim that “quantum computers don’t exist” which is true because nobody uses a computer to break crypto, they use specialized custom chips. All ECC (X25519-P521) will be broken by private sector quantum chips before RSA-2048 due to the physical limitations of stabilizing qubits. The people making false claims against RSA are either being paid or they are useful idiots.

daeken 6y ago
Wut. This is just false. D-Wave provides the "quantum computers" that others have and they're completely irrelevant when it comes to breaking ECC (or RSA, for that matter; ECC is broken by a variant of Shor's algorithm, which is used to break RSA). They're quantum annealing chips, not general-purpose quantum computers; they literally can't run Shor's algorithm, now or ever. We're orders of magnitudes out (qubit-wise, on real quantum computers) from breaking RSA or ECC in practice, and the difficulty level is on the same order for both.
- duskwuff 6y ago
  I'm not convinced that D-Wave's hardware is relevant to anything beyond D-Wave's profits. It's neat that their technology works, I guess, but it isn't clear at this point that it does anything better than a classical computer could.
archgoon 6y ago
That comment goes off the rails once it starts talking about quantum computers breaking encryption (and only ECC, not RSA). Yes, (real) Quantum computers can break ECC and RSA encryption. I have no idea why they think the NSA (and apparently Google as well) has secret Quantum Computers that are capable of breaking ECC, but not RSA.
- blepblep 6y ago
  Not to say I agree with that comment. But I think the case for why ECC would be easier to break than RSA using quantum computing is that key sizes of ECC are much smaller so would require less qbits to break.
  - archgoon 6y ago
    You can break a 160 bit EC with a 1000 qubit quantum machine. An equivalent 1024 RSA bit key needs about 2000 qbuits. (The following paper has a cool table and formula for working out how many you need for each) https://arxiv.org/pdf/quant-ph/0301141.pdf https://arxiv.org/pdf/quant-ph/0301141.pdf My incredulity is in the idea that Google and the NSA apparently have 1000 qubit machines that can do that, but not 2000 qubit ones (and you should be very confident that will remain the case in future). Note that once you're at the "I have a stable 1000 qubit machine that can perform complex calculations" realm, you can consider doing things like entangling it with that other 1000 qubit machine you have lying around, bringing yourself rapidly into the 2000 qubit realm. Getting to the first part is really hard. If you can pull that off, you're probably only a few years away from the second. The main thing that's stopping us from doing that today is that the (physcial) qubits we've made so far aren't stable enough; getting to a single logical qubit is anticipated to take 1000 physical ones. https://en.wikipedia.org/wiki/Physical_and_logical_qubits https://en.wikipedia.org/wiki/Physical_and_logical_qubits
    - aborsy 6y ago
      The few thousands qubits that you mentioned is logical qubits. With error correction you need tens of millions of physical qubits to break RSA or ECC. Google and NSA can produce more of the same thing. But they probably have no major secret sauce for things such as error correction that the public does not have.
      - deleted 6y ago
        [deleted]
wbl 6y ago
I'm actually a cryptography engineer. RSA encryption standards are hard to implement correctly. Frequently they contain padding oracles. There are safe ways to do RSA people don't do in standards. ECC eschews all that complexity. Writing a safe ECC implementation especially for Edwards or Montgomery curves is pretty simple. PGP is mortebund and has a lot of cruft. RSA does some things that are really cool like accumulators, Pallier, etc. But if you are doing them you are doing black magic.
upofadown 6y ago
Curves are 2 to 3 times easier to break than RSA using Shor's algorithm on a hypothetical quantum computer but that is not enough of a factor to really make a difference.

daeken 6y ago

Wut. This is just false. D-Wave provides the "quantum computers" that others have and they're completely irrelevant when it comes to breaking ECC (or RSA, for that matter; ECC is broken by a variant of Shor's algorithm, which is used to break RSA). They're quantum annealing chips, not general-purpose quantum computers; they literally can't run Shor's algorithm, now or ever. We're orders of magnitudes out (qubit-wise, on real quantum computers) from breaking RSA or ECC in practice, and the difficulty level is on the same order for both.

duskwuff 6y ago
I'm not convinced that D-Wave's hardware is relevant to anything beyond D-Wave's profits. It's neat that their technology works, I guess, but it isn't clear at this point that it does anything better than a classical computer could.

archgoon 6y ago

That comment goes off the rails once it starts talking about quantum computers breaking encryption (and only ECC, not RSA). Yes, (real) Quantum computers can break ECC and RSA encryption. I have no idea why they think the NSA (and apparently Google as well) has secret Quantum Computers that are capable of breaking ECC, but not RSA.

blepblep 6y ago
Not to say I agree with that comment. But I think the case for why ECC would be easier to break than RSA using quantum computing is that key sizes of ECC are much smaller so would require less qbits to break.
- archgoon 6y ago
  You can break a 160 bit EC with a 1000 qubit quantum machine. An equivalent 1024 RSA bit key needs about 2000 qbuits. (The following paper has a cool table and formula for working out how many you need for each) https://arxiv.org/pdf/quant-ph/0301141.pdf https://arxiv.org/pdf/quant-ph/0301141.pdf My incredulity is in the idea that Google and the NSA apparently have 1000 qubit machines that can do that, but not 2000 qubit ones (and you should be very confident that will remain the case in future). Note that once you're at the "I have a stable 1000 qubit machine that can perform complex calculations" realm, you can consider doing things like entangling it with that other 1000 qubit machine you have lying around, bringing yourself rapidly into the 2000 qubit realm. Getting to the first part is really hard. If you can pull that off, you're probably only a few years away from the second. The main thing that's stopping us from doing that today is that the (physcial) qubits we've made so far aren't stable enough; getting to a single logical qubit is anticipated to take 1000 physical ones. https://en.wikipedia.org/wiki/Physical_and_logical_qubits https://en.wikipedia.org/wiki/Physical_and_logical_qubits
  - aborsy 6y ago
    The few thousands qubits that you mentioned is logical qubits. With error correction you need tens of millions of physical qubits to break RSA or ECC. Google and NSA can produce more of the same thing. But they probably have no major secret sauce for things such as error correction that the public does not have.
    - deleted 6y ago
      [deleted]

wbl 6y ago

I'm actually a cryptography engineer. RSA encryption standards are hard to implement correctly. Frequently they contain padding oracles. There are safe ways to do RSA people don't do in standards. ECC eschews all that complexity. Writing a safe ECC implementation especially for Edwards or Montgomery curves is pretty simple. PGP is mortebund and has a lot of cruft. RSA does some things that are really cool like accumulators, Pallier, etc. But if you are doing them you are doing black magic.

upofadown 6y ago

Curves are 2 to 3 times easier to break than RSA using Shor's algorithm on a hypothetical quantum computer but that is not enough of a factor to really make a difference.