4 ms·

Isn't all this post quantum stuff a little premature? The standards haven't settled. We don't even know if there is a possible quantum threat to cryptography ye

Isn't all this post quantum stuff a little premature? The standards haven't settled. We don't even know if there is a possible quantum threat to cryptography yet. The more we work on the problem the less likely it seems. Last I heard we were 1 or 2 orders of magnitude away from physical noise performance that would make such a threat possible. Edit, added: Harvest now, decrypt later applies to any encrypted data. There is nothing special about the quantum threat. This all only makes sense if we can predict what the actual threat is ... and so far we can't. This reminds me of Pascal's Wager[1] [1] https://en.wikipedia.org/wiki/Pascal%27s_wager https://en.wikipedia.org/wiki/Pascal%27s_wager

dijit 3y ago
You'd be right except that anything encrypted now can be stored and cracked later. I remember as part of the snowden leaks there was documentation about this kind of delayed phase collection. Basically store as much signals data as you can and try to crack it later if there's a weakness discovered with the protocol or computing power starts being capable of wholesale attack. You might remember that hashes are significantly easier to crack with "rainbow tables", and so we added cryptographic "salts" to online password storage. We discovered that about 15 years ago and started salting all our passwords, but for a large window of time all of those old leaked databases were suddenly extremely easy to crack. Now, Imagine the NSA is 10 years ahead of us (and you might be close with that estimation), so even if they can't crack RSA right now they're much closer than we are, and even we get there we will likely have a large window of time before we fix it properly. (not that we're talking RSA here, but you get my point). https://www.forbes.com/sites/andygreenberg/2013/06/20/leaked-nsa-doc-says-it-can-collect-and-keep-your-encrypted-data-as-long-as-it-takes-to-crack-it/ https://www.forbes.com/sites/andygreenberg/2013/06/20/leaked...
- astrange 3y ago
  RSA isn't anywhere near 10 years away from being attackable with a classical computer. (More like eons.) It's not a matter of time, it's just a matter of quantum computers existing.
- upofadown 3y ago
  That Forbes article is about a loophole involving encryption that could allow the NSA to collect and store data that they might not otherwise be able to. Now that everything is encrypted, that loophole might cover everything. Nothing in the article implies that the NSA can magically collect all the encrypted data in the world and keep it for many years.
Octoth0rpe 3y ago
One reason to move sooner rather than later is to mitigate the threat of previously stored data. There may be a government entity simply storing all imessage traffic in the hopes of one day decrypting it when/if a breakthrough happens. If you transition sooner, you increase the age of the latest data that could be decrypted, thusly hopefully making it safer.
- earthwalker99 3y ago
  this is capitalism. why would they care unless the decryption happens this fiscal quarter?
whizzter 3y ago
Like the article says, it's protection from harvest-now-break-later. Apple users and communications are today a state-secret affair as shown by the impact of NSO/Pegasus. So even if Google,IBM,et al _might_ have approached feasibility in the open there is still a significant risk in state-level adversaries having poured enough funding to still be ahead, plus they will benefit from all open research in the hidden with extra funding to take more leaps. So no, it's not premature if there is hidden or open leaps just 10 years in the future.
raccoonDivider 3y ago
> Edit, added: Harvest now, decrypt later applies to any encrypted data. There is nothing special about the quantum threat. This all only makes sense if we can predict what the actual threat is ... and so far we can't. But we know Shor's algorithm, and we've started building prototype quantum computers. Isn't that enough to build something that counters them? Worst case, we deploy new ciphers and realize that the threat was empty 50 years from now. What's the downside?
SheinhardtWigCo 3y ago
> Last I heard we were 1 or 2 orders of magnitude away from physical noise performance that would make such a threat possible. The entities with the most to gain from such an advancement are not exactly known for publicizing their achievements.
bprater 3y ago
From the article: >> Although quantum computers with this capability don’t exist yet, extremely well-resourced attackers can already prepare for their possible arrival by taking advantage of the steep decrease in modern data storage costs. The premise is simple: such attackers can collect large amounts of today’s encrypted data and file it all away for future reference. Even though they can’t decrypt any of this data today, they can retain it until they acquire a quantum computer that can decrypt it in the future, an attack scenario known as Harvest Now, Decrypt Later.
tptacek 3y ago
We have reason to believe that conventionally encrypted data isn't threatened within the next 50 years by anything other than quantum computing, which is what's special about the quantum threat.

dijit 3y ago

You'd be right except that anything encrypted now can be stored and cracked later. I remember as part of the snowden leaks there was documentation about this kind of delayed phase collection. Basically store as much signals data as you can and try to crack it later if there's a weakness discovered with the protocol or computing power starts being capable of wholesale attack. You might remember that hashes are significantly easier to crack with "rainbow tables", and so we added cryptographic "salts" to online password storage. We discovered that about 15 years ago and started salting all our passwords, but for a large window of time all of those old leaked databases were suddenly extremely easy to crack. Now, Imagine the NSA is 10 years ahead of us (and you might be close with that estimation), so even if they can't crack RSA right now they're much closer than we are, and even we get there we will likely have a large window of time before we fix it properly. (not that we're talking RSA here, but you get my point). https://www.forbes.com/sites/andygreenberg/2013/06/20/leaked-nsa-doc-says-it-can-collect-and-keep-your-encrypted-data-as-long-as-it-takes-to-crack-it/ https://www.forbes.com/sites/andygreenberg/2013/06/20/leaked...

astrange 3y ago
RSA isn't anywhere near 10 years away from being attackable with a classical computer. (More like eons.) It's not a matter of time, it's just a matter of quantum computers existing.
upofadown 3y ago
That Forbes article is about a loophole involving encryption that could allow the NSA to collect and store data that they might not otherwise be able to. Now that everything is encrypted, that loophole might cover everything. Nothing in the article implies that the NSA can magically collect all the encrypted data in the world and keep it for many years.

Octoth0rpe 3y ago

One reason to move sooner rather than later is to mitigate the threat of previously stored data. There may be a government entity simply storing all imessage traffic in the hopes of one day decrypting it when/if a breakthrough happens. If you transition sooner, you increase the age of the latest data that could be decrypted, thusly hopefully making it safer.

earthwalker99 3y ago
this is capitalism. why would they care unless the decryption happens this fiscal quarter?

whizzter 3y ago

Like the article says, it's protection from harvest-now-break-later. Apple users and communications are today a state-secret affair as shown by the impact of NSO/Pegasus. So even if Google,IBM,et al _might_ have approached feasibility in the open there is still a significant risk in state-level adversaries having poured enough funding to still be ahead, plus they will benefit from all open research in the hidden with extra funding to take more leaps. So no, it's not premature if there is hidden or open leaps just 10 years in the future.

raccoonDivider 3y ago

> Edit, added: Harvest now, decrypt later applies to any encrypted data. There is nothing special about the quantum threat. This all only makes sense if we can predict what the actual threat is ... and so far we can't. But we know Shor's algorithm, and we've started building prototype quantum computers. Isn't that enough to build something that counters them? Worst case, we deploy new ciphers and realize that the threat was empty 50 years from now. What's the downside?

SheinhardtWigCo 3y ago

> Last I heard we were 1 or 2 orders of magnitude away from physical noise performance that would make such a threat possible. The entities with the most to gain from such an advancement are not exactly known for publicizing their achievements.

bprater 3y ago

From the article: >> Although quantum computers with this capability don’t exist yet, extremely well-resourced attackers can already prepare for their possible arrival by taking advantage of the steep decrease in modern data storage costs. The premise is simple: such attackers can collect large amounts of today’s encrypted data and file it all away for future reference. Even though they can’t decrypt any of this data today, they can retain it until they acquire a quantum computer that can decrypt it in the future, an attack scenario known as Harvest Now, Decrypt Later.

tptacek 3y ago

We have reason to believe that conventionally encrypted data isn't threatened within the next 50 years by anything other than quantum computing, which is what's special about the quantum threat.