2 ms·
> QC has no practical impact on symmetric or hash algorithms It would require a doubling of key lengths to maintain security against quantum Grover search atta
by tromp 4y ago
> QC has no practical impact on symmetric or hash algorithms
It would require a doubling of key lengths to maintain security against quantum Grover search attacks.
> to create the first NIST-certified asymmetric algorithms believed to not be vulnerable to quantum attack
That will likely lead to much more than a doubling of key sizes; perhaps two orders of magnitude bigger. It will severely impact resource constrained cryptographic devices such as credit card chips.
- api 4y ago> It would require a doubling of key lengths to maintain security against quantum Grover search attacks. Grover could in theory reduce a 256-bit cipher like AES-256 or ChaCha to a 128-bit cipher. 128 bits is still far beyond what can be brute forced with any sane or practical amount of resources or time. It would mean 128-bit keys would be unsafe, but 256-bit or higher has been recommended for years anyway for reasons beyond QC like birthday attacks. Also keep in mind that this is a theoretical (as in big-O notation) speedup. Real world performance would depend a ton on the speed of the quantum computer. If a QC running Grover's algorithm isn't at least as fast as e.g. a conventional CPU then it might not be much faster in practice than a custom ASIC brute forcing a full strength key. That would make it pretty much an academic demo, not even useful in practice against 128-bit keys.