9 ms·
NIST announces preliminary winners of post-quantum competition
- atoav 4y agoThe winner for encyption https://pq-crystals.org/kyber/ https://pq-crystals.org/kyber/ The winner for signing stuff: https://pq-crystals.org/dilithium/index.shtml https://pq-crystals.org/dilithium/index.shtml
- texaslonghorn5 4y agoThey did a great job naming things!
- dogeprotocol 4y agoNot just these two, there are a few more that have been standardized and few more that moved to Round 4. Digital Signatures standardized: Falcon SPHINCS+ Advancing to Round 4 (Key Exchange): BIKE Classic McEliece HQC SIKE There will also be another program for post-quantum Digital Signature schemes with smaller signature size.
- Tepix 4y agoHuge congrats to the teams: Dilithium: Léo Ducas, Eike Kiltz, Tancrède Lepoint, Vadim Lyubashevsky, Peter Schwabe, Gregor Seiler, and Damien Stehlé Kyber: Roberto Avanzi, Joppe Bos, Léo Ducas, Eike Kiltz, Tancrède Lepoint, Vadim Lyubashevsky, John M. Schanck, Peter Schwabe, Gregor Seiler, and Damien Stehlé.
- Dracophoenix 4y agoAre the words "Dilithium" and "Kyber" trademarked/copyrighted? Lucasfilm owns the copyright one for the word "droid". I would think anything to do with the EU/Legends would also have a trademark or copyright on it.
- yakak 4y agoIs Lucasfilms in the cryptography trade?
- amalcon 4y agoA quick search indicates that there are a bunch of companies named "Dilithium". There are also several chemical compounds with "Dilithium" in their names.
- dwringer 4y agoDilithium is a compound comprised by molecules of two covalently-bonded Lithium atoms, and Kyber is a romanization of the greek root for "cyber", so they are relatively safe from litigation. "Droid" was a deliberate alternative to "android" coined specifically for the Star Wars franchise. At least AFAIK, so the argument goes.
- Dracophoenix 4y agoThank you. That sounds like reasonable answer.
- teddyh 4y agoAFAIK, single words cannot be copyrighted, only trademarked.
- artemonster 4y agoAfter EC DRBG who cares about what NIST does?
- e4m2 4y agoThose who have to comply with their standards (e.g. FIPS 140-3), at the very least.
- cipherboy 4y agoOP does have a point though, especially with DJB's thoughts (and others) on the matter. https://nitter.net/hashbreaker?lang=en https://nitter.net/hashbreaker?lang=en For FIPS in particular, they've first gotta sunset the traditional algorithms for anyone to strictly need to care (and even then, parallel constructions of PQC+traditional could let other PQC algorithms in -- like the Chrome experiments -- from a FIPS perspective, you can treat the PQC like plaintext). And for them to be useful, adoption needs to occur in the IETF communities (PKIX, TLS, SSH, IKE, ...). You're probably looking at least 5 years on the adoption window to customers running the lastest updates. NIST's blessing might help some of the IETF conversations that now need to happen. But not listening to DJB, given his track record, likely will anger a subset of IETF contributors and might hinder adoption. It'll be interesting to see if IETF takes the more conservative approach advocates by DJB or if they continue on with NIST's blessing alone. But I'm just a watcher... :-) Edit: and for the record, FIPS never mandated Dual EC DRBG but it was still a mistake for NIST to rubber stamp.
- rvz 4y ago> For encryption, NIST recommends the use of CRYSTALS-Kyber, although that recommendation may still change. For signatures, NIST has selected CRYSTALS-Dilithium as the primary algorithm, plus two additional algorithms, Falcon and SPHINCS+. This great news for all teams involved, including the team members behind Falcon who some of them have developed the Algorand blockchain, which most highly likely be using Falcon for quantum resistance for many years to come.
- what-imright 4y agowho still trusts NIST?
- arthurcolle 4y agopeople who have to buy SRMs
- gred 4y agoYou're getting downvoted, but it's a good question. There was a recent paper linked on HN that goes into a lot of the nuance around this question. It's very good (IMO, as an interested outsider): https://news.ycombinator.com/item?id=31856029 https://news.ycombinator.com/item?id=31856029
- denton-scratch 4y agoTrust, but verify.
- SnowHill9902 4y agoAre you really able to verify at this level of mathematics?
- denton-scratch 4y agoIt was meant as a sort of joke; perhaps I should have added some kind of smiley. Of course I can't do the verification myself. But there are people (stand up, DJB) who can, and I can pay attention to their observations. So perhaps "Trust, but verify by proxy". But that wouldn't have been recognisable as the well-known cold-war slogan...
- macksd 4y agoWhile I get your point, is there someone better to trust? Not every cryptographer works for the NSA, and I can't think of a way for a protocol to be looked at by as many cryptographers for flaws as the one chosen by NIST to be a standard. Maybe the runner-up that WASN'T chosen by NIST is possibly NOT the one the NSA knows about a flaw in?
- aliljet 4y agoWhat an odd announcement. Is NIST not sure about the patents relating to their selected winners? "NIST expects to execute the various agreements prior to publishing the standard. If the agreements are not executed by the end of 2022, NIST may consider selecting NTRU instead of KYBER. NTRU was proposed in 1996, and U.S. patents were dedicated to the public in 2007."
- icegreentea2 4y agoYeah, the full context of the footnote is: "Issues relating to patents were a factor in NIST’s decision during thethird round as NIST became aware of various third-party patents. As noted in Section 2.2.3, NIST negotiated with several third parties to enter into various agreements to overcome potential adoption challenges posed by third-party patents." And elsewhere in the report: "In addition, NIST has engaged with third parties that own various patents directed to cryptography, and NIST acknowledges cooperation of ISARA, Philippe Gaborit, Carlos Aguilar Melchor, the laboratory XLIM, the French National Center for Scientific Research (CNRS), the University of Limoges, and Dr. Jintai Ding. NIST and these third parties are finalizing agreements such that the patents owned by the third parties will not be asserted against implementers (or end-users) of a standard for the selected cryptographic algorithm. NIST appreciates the efforts of those who helped obtain this outcome and the cooperation of the third parties." So yeah, NIST realized part way through the competition that various 3rd party patents might conflict with KYBER and is trying to de-conflict. It seems like NIST probably got various 'handshake level' agreements before selecting KYBER (otherwise they would just be... really really irresponsible), and is trying to get the final signed agreements done.
- throwaway0x7E6 4y agoI really hope quantum computing continues to advance at the nonexistent rate it does then. 1312+ byte public keys are gonna suck badly for a lot of applications. hopefully, SPHINCS+ becomes ubiquitous (although it also isn't great comparing to ECC due to large 8 KiB signatures), or another similar alternative emerges
- TobTobXX 4y agoReally great to see that NIST takes patents into consideration as a negative point, even exerting pressure on the KYBER patent holders.
- suprjami 4y agoThe preliminary winners are currently in superposition. NIST will soon observe them to announce the final winner.