5 ms·

Major systems and big companies like Google are already mid-transition to PQC. So it is alarming.

by j2kun 3y ago

anonymousDan 3y ago
Furthermore this could have implications for fully homomorphic encryption schemes based on lattices. But nonetheless I laughed :)
- rgmerk 3y ago
  So a thing which is currently useless because it runs at a speed that makes the Harvard Mark I look fast, might be rendered useless if a thing that doesn’t physically exist despite decades of effort is constructed? :P)
AnthonyMouse 3y ago
More to the point, the purpose of the encrypting system nobody uses is to have something to use if anybody ever makes the computer that doesn't exist. Now if that happens, what?
- tempaway4785751 3y ago
  We really need to get people to take really complicated risks that might never come to pass much more seriously. Perhaps someone smart can explain the really complicated risks that might never come to pass to the government that doesn't really look beyond the three year time horizon and get them to allocate some of their money that doesn't really exist to help.
troq13 3y ago
Google has dozens of chrome extensions in their app store that anyone can check in 2 mins are plain malware, and they do nothing about it. If they cared about security that's what they would be working on, these guys just want to publish papers.
- j2kun 3y ago
  I'm sure they have thought more about how to prioritize security threats than an anonymous internet commenter.
  - troq13 3y ago
    The fact that you work at Google and did not care to ask what are the extensions just confirms to me nobody there cares.
    - basementcat 3y ago
      I’ll bite; what are some of these extensions?
      - troq13 3y ago
        HBO watch party. If relays a fake costumer support chat if you visit a site like united airlines, that puts you in touch with scammers (probably does other malwary stuff too). A friend almost got scammed by this, they reported it to someone they know who works at Google and a couple months later the extension is still up. Tbh that is the only actual example I know, but after poking around a bit, ppl who actually know about security say that's the state of things with these extension and app store apps, and nobody at google seems to think fixing it is their job. Funny thing is, they were asking this google friend for advice about getting rid of the malicious chat before they realized it was this chrome extension. The advice the google employee gave was to format the computer (it wouldn't have fixed it because once they logged into chrome again all the extensions would come back). Hard sell that people running this clown show could be doing PQC in any meaningful sense (other than publishing papers. The papers are fine).
        j2kun 3y ago
        There was a previous one removed a few months ago for malware called HBO Max Watch Party. Was that it? If you have a specific extension id I can file a bug on your behalf. And after reading about the situation internally, I can confirm there are dozens of people working on this problem, and that you have no idea what you're talking about. So please try to be a bit more humble.
adastra22 3y ago
Their deployment is additive. You would need to break both the PCQ and classical schemes, so they’d be unaffected here.
- less_less 3y ago
  They wouldn't be immediately hacked, especially as this is a quantum algorithm anyway. But if it turns out that the current PQC schemes are not quantum-resistant, then that work will need to be redone (unless the progress in quantum computing stalls out, I guess). The current result does not break Kyber / Dilithium / NTRU variants / Falcon / FrodoKEM even assuming it's correct, but obviously there's some concern that the a follow-up result might improve on it. The NIST process has been running for 7 years, though they do have a few "non-lattice" schemes waiting for a 4th round of standardization: the code-based schemes Classic McEliece, BIKE and HQC. We could switch over to those, and the work to add crypto-agility to protocols would not be wasted, but the work on lattice software and hardware would be largely wasted. Also, error-correcting codes are also solving short-vector problems in a lattice! But since the lattice has a different shape maybe it would be fine? After codes the list gets pretty thin... like there's CSIDH, but it's very slow, has partial quantum attacks, and it isn't very trusted after SIKE got broken in half.
  - adgjlsfhk1 3y ago
    there's always post quantum rsa https://eprint.iacr.org/2017/351.pdf https://eprint.iacr.org/2017/351.pdf. yes it sucks, but at least for the quantum computers we're likely to have 20 years from now, you could probably get away with a 1gb key...
    - adastra22 3y ago
      Lamport signatures work and are PQC. There are solutions that are practical to use (1gb rsa keys are not). Just not drop in replacements without large tradeoffs.

Major systems and big companies like Google are already mid-transition to PQC. So it is alarming.

by j2kun 3y ago

Major systems and big companies like Google are already mid-transition to PQC. So it is alarming.

Furthermore this could have implications for fully homomorphic encryption schemes based on lattices. But nonetheless I laughed :)

rgmerk 3y ago
So a thing which is currently useless because it runs at a speed that makes the Harvard Mark I look fast, might be rendered useless if a thing that doesn’t physically exist despite decades of effort is constructed? :P)

AnthonyMouse 3y ago

More to the point, the purpose of the encrypting system nobody uses is to have something to use if anybody ever makes the computer that doesn't exist. Now if that happens, what?

tempaway4785751 3y ago
We really need to get people to take really complicated risks that might never come to pass much more seriously. Perhaps someone smart can explain the really complicated risks that might never come to pass to the government that doesn't really look beyond the three year time horizon and get them to allocate some of their money that doesn't really exist to help.

troq13 3y ago

Google has dozens of chrome extensions in their app store that anyone can check in 2 mins are plain malware, and they do nothing about it. If they cared about security that's what they would be working on, these guys just want to publish papers.

j2kun 3y ago
I'm sure they have thought more about how to prioritize security threats than an anonymous internet commenter.
- troq13 3y ago
  The fact that you work at Google and did not care to ask what are the extensions just confirms to me nobody there cares.
  - basementcat 3y ago
    I’ll bite; what are some of these extensions?
    - troq13 3y ago
      HBO watch party. If relays a fake costumer support chat if you visit a site like united airlines, that puts you in touch with scammers (probably does other malwary stuff too). A friend almost got scammed by this, they reported it to someone they know who works at Google and a couple months later the extension is still up. Tbh that is the only actual example I know, but after poking around a bit, ppl who actually know about security say that's the state of things with these extension and app store apps, and nobody at google seems to think fixing it is their job. Funny thing is, they were asking this google friend for advice about getting rid of the malicious chat before they realized it was this chrome extension. The advice the google employee gave was to format the computer (it wouldn't have fixed it because once they logged into chrome again all the extensions would come back). Hard sell that people running this clown show could be doing PQC in any meaningful sense (other than publishing papers. The papers are fine).
      - j2kun 3y ago
        There was a previous one removed a few months ago for malware called HBO Max Watch Party. Was that it? If you have a specific extension id I can file a bug on your behalf. And after reading about the situation internally, I can confirm there are dozens of people working on this problem, and that you have no idea what you're talking about. So please try to be a bit more humble.

adastra22 3y ago

Their deployment is additive. You would need to break both the PCQ and classical schemes, so they’d be unaffected here.

less_less 3y ago
They wouldn't be immediately hacked, especially as this is a quantum algorithm anyway. But if it turns out that the current PQC schemes are not quantum-resistant, then that work will need to be redone (unless the progress in quantum computing stalls out, I guess). The current result does not break Kyber / Dilithium / NTRU variants / Falcon / FrodoKEM even assuming it's correct, but obviously there's some concern that the a follow-up result might improve on it. The NIST process has been running for 7 years, though they do have a few "non-lattice" schemes waiting for a 4th round of standardization: the code-based schemes Classic McEliece, BIKE and HQC. We could switch over to those, and the work to add crypto-agility to protocols would not be wasted, but the work on lattice software and hardware would be largely wasted. Also, error-correcting codes are also solving short-vector problems in a lattice! But since the lattice has a different shape maybe it would be fine? After codes the list gets pretty thin... like there's CSIDH, but it's very slow, has partial quantum attacks, and it isn't very trusted after SIKE got broken in half.
- adgjlsfhk1 3y ago
  there's always post quantum rsa https://eprint.iacr.org/2017/351.pdf https://eprint.iacr.org/2017/351.pdf. yes it sucks, but at least for the quantum computers we're likely to have 20 years from now, you could probably get away with a 1gb key...
  - adastra22 3y ago
    Lamport signatures work and are PQC. There are solutions that are practical to use (1gb rsa keys are not). Just not drop in replacements without large tradeoffs.