5 ms·
"Of course, one big concern is that everybody is trying to standardize cryptosystems that are relatively young. What if the industry (or NIST) picks something t
by beloch 2y ago
"Of course, one big concern is that everybody is trying to standardize cryptosystems that are relatively young. What if the industry (or NIST) picks something that’s not secure? What if they pick something that will break tomorrow?"
If information remains interesting to an adversary long-term, they can always archive classically ciphered text and apply future hardware and algorithmic advances to cracking it.
This is why "post-quantum" cryptography may well be "quantum cryptography". QC must be broken at the time of transmission for an adversary to obtain any information at all. If you're trying to communicate something that will remain sensitive long-term, with QC you aren't betting against the future producing something surprising.
QC already works, it's getting cheaper and faster, and more network friendly. It's not ready for the internet yet, but it's getting there. We don't need it for information that changes every few years, like credit card info, but that's not all people use cryptography for, even today.
- awestroke 2y agoThat sounds very interesting. Where can I read more about QC over internet and how we’re getting closer to it?
- DebtDeflation 2y agohttps://scottlocklin.wordpress.com/2019/01/15/quantum-computing-as-a-field-is-obvious-bullshit/ https://scottlocklin.wordpress.com/2019/01/15/quantum-comput...
- marcosdumay 2y agoQC requires direct contact between sender and receiver (if you have direct contact, why do you care about cryptography at all?); can't be used on stored data; can't prove authenticity; and can inherently be broken by a man in the middle attack. So, no, it's not a viable replacement for anything.
- fsh 2y agoQuantum key distribution is completely unsuitable to replace asymmetric cryptography, even when ignoring the (enormous) technological difficulties. It fundamentally cannot handle authentication, and requires a pre-shared key to prevent MITM-attacks, so one can replace it with any modern stream cipher (which are astronomically more econonical and don't require physical point-to-point connections). Even exchanging an SSD with a long key and using a one-time pad is far superior to QKD.
- HappyPanacea 2y agoCan't we sign the key with SPHINCS+ and be back to the same situation as with classical asymmetric cryptography?
- pclmulqdq 2y agoDon't knock sending around gigantic one-time pads on SSDs until you try it :) In all seriousness, QKD also has huge SNR problems over long range. QKD is really a layer 1 protocol that needs you to entangle qubits far away from each other, and that relies on having a very clean physical layer. You can sort of do it over short-range fiber right now with a known-to-be-direct connection, but any other medium is still off the table. Once you have done the QKD layer 1, put any protocol you want on top of it.
- vlovich123 2y agoQC at a very very very limited scale works and it’s not clear that it can be made to scale to solve problems faster than classical.