4 ms·
One perpetual source of concern that I have is how will this work in practice? NIST has not standardized algorithms as of yet. NSA has come out in opposition of
by er4hn 2y ago
One perpetual source of concern that I have is how will this work in practice? NIST has not standardized algorithms as of yet. NSA has come out in opposition of hybrid schemes (note that NSA is also a big fan of CsfC, which uses entirely seperate dual layers of crypto, which could be how they would have a hybrid scheme - one layer classical, one layer pqc. Will they? I ahve no clue). But this protocol is still a draft.
OpenSSH has chosen their own algorithm that afaik was on the NIST shortlist for PQC but not a final candidate and incorporated it in OpenSSH. That's not standardized either.
Given that Govt (which mandates encryption requirements via blunt tools like saying they will only purchase things that meet their requirements) and Industry are going two ways, and industry is doing whatever they think best without waiting for standardization, it feels like this is going to be a source of headaches to support properly in the future due to the diversity of schemes.
I am actually in favor of what Google / OpenSSH are doing, enabling new things shouldn't be breaking stuff, and should just be a net positive in their own bubbles, but the govt opposition and foot dragging makes this harder.
- tptacek 2y agoEverybody is going to use hybrid schemes for the foreseeable future.
- dadrian 2y agoUnlikely that signatures will ever be hybrid. Fairly likely we move off of hybrid for key exchange once NIST finishes standardization.
- thadt 2y agoGeez, turbolaser X-Wing before it even gets in the air. Can y'all just give us a SCW death-match debate on this? Jokes aside, it would be interesting to have your optimistic take on the current PQ security trajectory. Do you think that it has proven comparably secure to ECC? Or just that by the time PQ primitives are ready to be rolled out they'll be load bearing enough that it is better to use them solo rather than the added overhead/complexity of a hybrid?
- dadrian 2y agoI don't see TLS adopting anything other than the current hybrid or a pure Kyber, but Bas would know better than me. Signatures are very difficult to do hybrid in a way that's not strippable. I think lattices are in the realm of boring crypto these days, but I ask the actual mathematical cryptographers when I need real opinions.
- tptacek 2y agoWe're gonna fight about this!