4 ms·

Can anyone here shed any more light on this from the last six years?

na85 5y ago
The author is a HN user, hopefully he drops by.
opheliate 5y ago
Well, we still haven't got a standardised set of quantum-resistant cryptographic recommendations from NIST (expected to arrive 2022-2024), but since the article was released, the NSA have replaced Suite B with the CNSA [0]. CNSA is similar to Suite B, in that it is also not quantum-resistant, and also recommends AES, ECDH, ECDSA, and SHA-2. However, it also recommends RSA & classic Diffie-Hellman over multiplicative groups of integers, while Suite B exclusively recommended elliptic curve-based public-key crypto. Things are definitely in a bit of a weird state, the current messaging from the NSA [1] is pretty mixed: > For those partners and vendors that have not yet made the transition to Suite B elliptic curve algorithms, we recommend not making a significant expenditure to do so at this point but instead to prepare for the upcoming quantum resistant algorithm transition. > For those vendors and partners that have already transitioned to Suite B, we recognize that this took a great deal of effort on your part, and we thank you for your efforts. We look forward to your continued support as we work together to improve information security for National Security customers against the threat of a quantum computer being developed. Unfortunately, the growth of elliptic curve use has bumped up against the fact of continued progress in the research on quantum computing, which has made it clear that elliptic curve cryptography is not the long term solution many once hoped it would be. Thus, we have been obligated to update our strategy. > It is important to note that we aren't asking vendors to stop implementing the Suite B algorithms and we aren't asking our national security customers to stop using these algorithms. Rather, we want to give more flexibility to vendors and our customers in the present as we prepare for a quantum safe future. Where elliptic curve protocols are to be used, we prefer Suite B standards be used to the fullest extent possible as they have a long history of security evaluation and time tested implementation that newer proposals do not yet have. I think from any other crypto vendor, it would be a lot easier to take this at face value, but the NSA's incentives are so mixed, it's difficult to know what to think. 0: https://en.wikipedia.org/wiki/Commercial_National_Security_Algorithm_Suite https://en.wikipedia.org/wiki/Commercial_National_Security_A... 1: https://apps.nsa.gov/iaarchive/programs/iad-initiatives/cnsa-suite.cfm https://apps.nsa.gov/iaarchive/programs/iad-initiatives/cnsa...
- deleted 5y ago
  [deleted]
- CiPHPerCoder 5y ago
  > However, it also recommends RSA & classic Diffie-Hellman over multiplicative groups of integers, while Suite B exclusively recommended elliptic curve-based public-key crypto. I think their reasoning is probably along the lines of "large RSA keys will buy you a little bit more time to migrate than small ECC keys if a quantum computer emerged today, due to memory constraints with what we think quantum computer will look like".

na85 5y ago

The author is a HN user, hopefully he drops by.

Well, we still haven't got a standardised set of quantum-resistant cryptographic recommendations from NIST (expected to arrive 2022-2024), but since the article was released, the NSA have replaced Suite B with the CNSA [0]. CNSA is similar to Suite B, in that it is also not quantum-resistant, and also recommends AES, ECDH, ECDSA, and SHA-2. However, it also recommends RSA & classic Diffie-Hellman over multiplicative groups of integers, while Suite B exclusively recommended elliptic curve-based public-key crypto. Things are definitely in a bit of a weird state, the current messaging from the NSA [1] is pretty mixed: > For those partners and vendors that have not yet made the transition to Suite B elliptic curve algorithms, we recommend not making a significant expenditure to do so at this point but instead to prepare for the upcoming quantum resistant algorithm transition. > For those vendors and partners that have already transitioned to Suite B, we recognize that this took a great deal of effort on your part, and we thank you for your efforts. We look forward to your continued support as we work together to improve information security for National Security customers against the threat of a quantum computer being developed. Unfortunately, the growth of elliptic curve use has bumped up against the fact of continued progress in the research on quantum computing, which has made it clear that elliptic curve cryptography is not the long term solution many once hoped it would be. Thus, we have been obligated to update our strategy. > It is important to note that we aren't asking vendors to stop implementing the Suite B algorithms and we aren't asking our national security customers to stop using these algorithms. Rather, we want to give more flexibility to vendors and our customers in the present as we prepare for a quantum safe future. Where elliptic curve protocols are to be used, we prefer Suite B standards be used to the fullest extent possible as they have a long history of security evaluation and time tested implementation that newer proposals do not yet have. I think from any other crypto vendor, it would be a lot easier to take this at face value, but the NSA's incentives are so mixed, it's difficult to know what to think. 0: https://en.wikipedia.org/wiki/Commercial_National_Security_Algorithm_Suite https://en.wikipedia.org/wiki/Commercial_National_Security_A... 1: https://apps.nsa.gov/iaarchive/programs/iad-initiatives/cnsa-suite.cfm https://apps.nsa.gov/iaarchive/programs/iad-initiatives/cnsa...

deleted 5y ago
[deleted]
CiPHPerCoder 5y ago
> However, it also recommends RSA & classic Diffie-Hellman over multiplicative groups of integers, while Suite B exclusively recommended elliptic curve-based public-key crypto. I think their reasoning is probably along the lines of "large RSA keys will buy you a little bit more time to migrate than small ECC keys if a quantum computer emerged today, due to memory constraints with what we think quantum computer will look like".