3 ms·

> But even if a quantum computer is never built, new PQ standards are safer, more resilient, and more flexible than their classical counterparts. lol wat? Noth

> But even if a quantum computer is never built, new PQ standards are safer, more resilient, and more flexible than their classical counterparts. lol wat? Nothing could be further from the truth. Just a few years ago, two of the four finalists of the NIST PQC were broken so badly that you could break production key sizes in hours with a 10 year old Mac mini. Most PQC deployments aren’t broken because they double up with classical crypto systems so that you have to break both, but people who were using these schemes were basically wasting their time. Key sizes and signatures are typically much, much larger than classical cryptosystems. PQC systems lack the flexibility of classical cryptography. Generally speaking the linear structure of classical schemes is what quantum computers exploit, and so it is gone from most (all?) PQC systems. That linear structure is what lets you do things like make a 2-of-2 by adding pubkeys and signatures. I’m not sure what is meant by flexibility of not stuff like this.

some_furry 2y ago
> Just a few years ago, two of the four finalists of the NIST PQC were broken so badly that you could break production key sizes in hours with a 10 year old Mac mini. SIKE was not a Finalist, it was a Round 4 candidate. Candidates being broken before the process finishes is a sign of the process working.
- thesz 2y ago
  https://cacm.acm.org/news/nist-post-quantum-cryptography-candidate-cracked/ https://cacm.acm.org/news/nist-post-quantum-cryptography-can... "Belgian researchers have cracked the SIKE cryptographic algorithm, a fourth and final-round candidate that the U.S. National Institute of Standards and Technology (NIST) was evaluating for its Post-Quantum Cryptography (PQC) standard." SIKE was a finalist, it entered final round.
  - pclmulqdq 2y ago
    SIKE was probably the most exciting PQC algorithm available, if it hadn't been broken. It made it to the finals for a relatively brief time. CRYSTALS also now has a possible attack proposed by a recent paper on a similar algorithm, so time will tell if any more of these algorithms is broken.
    - tptacek 2y ago
      But SIKE was also broken in, like, a theatrical fashion. It was an explosive break! It feels like there's some dancing around happening here, where the subtext is that where an algorithm is in a NIST contest process isn't determinative on it's own, and that there are external reasons we tend to trust the lattice stuff (because it's been studied for decades, &c).
      - adastra22 2y ago
        Even with lattice stuff, the parameters keep having to be changed to ensure security. It may not be explosive breaks, but the cryptanalysis is advancing at stunning speeds. This stuff is no where near prime time ready.
        tptacek 2y ago
        I think we are agreeing, directionally. I don't have a strong opinion in either direction and wouldn't be qualified to express one. I'm a vulnerability researcher with a little bit of cryptography to me, so I tend always to err on the side of utterly skeeved out. I assume, regardless of what national standards bodies recommend, this stuff will all be run hybrid for the foreseeable future, but who knows? I don't think anybody can easily shut down the argument that it's too early for lattice PQC to simply replace ECDLP cryptography.
        adastra22 2y ago
        There is not any reason to NOT run hybrid cryptography schemes right now, when the use case allows for it. I do worry though that early standardization might lock us into a bad standard, and current PQC systems are too inflexible to allow for many use cases. The latter point means that if you want PQC, you might have to give up some features. E.g. multikey signature schemes, zero knowledge proofs, etc.
        CiPHPerCoder 2y ago
        > There is not any reason to NOT run hybrid cryptography schemes right now, when the use case allows for it. This is reasonable, but runs contrary to the stance taken by CNSA 2.0.

some_furry 2y ago

> Just a few years ago, two of the four finalists of the NIST PQC were broken so badly that you could break production key sizes in hours with a 10 year old Mac mini. SIKE was not a Finalist, it was a Round 4 candidate. Candidates being broken before the process finishes is a sign of the process working.

thesz 2y ago
https://cacm.acm.org/news/nist-post-quantum-cryptography-candidate-cracked/ https://cacm.acm.org/news/nist-post-quantum-cryptography-can... "Belgian researchers have cracked the SIKE cryptographic algorithm, a fourth and final-round candidate that the U.S. National Institute of Standards and Technology (NIST) was evaluating for its Post-Quantum Cryptography (PQC) standard." SIKE was a finalist, it entered final round.
- pclmulqdq 2y ago
  SIKE was probably the most exciting PQC algorithm available, if it hadn't been broken. It made it to the finals for a relatively brief time. CRYSTALS also now has a possible attack proposed by a recent paper on a similar algorithm, so time will tell if any more of these algorithms is broken.
  - tptacek 2y ago
    But SIKE was also broken in, like, a theatrical fashion. It was an explosive break! It feels like there's some dancing around happening here, where the subtext is that where an algorithm is in a NIST contest process isn't determinative on it's own, and that there are external reasons we tend to trust the lattice stuff (because it's been studied for decades, &c).
    - adastra22 2y ago
      Even with lattice stuff, the parameters keep having to be changed to ensure security. It may not be explosive breaks, but the cryptanalysis is advancing at stunning speeds. This stuff is no where near prime time ready.
      - tptacek 2y ago
        I think we are agreeing, directionally. I don't have a strong opinion in either direction and wouldn't be qualified to express one. I'm a vulnerability researcher with a little bit of cryptography to me, so I tend always to err on the side of utterly skeeved out. I assume, regardless of what national standards bodies recommend, this stuff will all be run hybrid for the foreseeable future, but who knows? I don't think anybody can easily shut down the argument that it's too early for lattice PQC to simply replace ECDLP cryptography.
        adastra22 2y ago
        There is not any reason to NOT run hybrid cryptography schemes right now, when the use case allows for it. I do worry though that early standardization might lock us into a bad standard, and current PQC systems are too inflexible to allow for many use cases. The latter point means that if you want PQC, you might have to give up some features. E.g. multikey signature schemes, zero knowledge proofs, etc.
        CiPHPerCoder 2y ago
        > There is not any reason to NOT run hybrid cryptography schemes right now, when the use case allows for it. This is reasonable, but runs contrary to the stance taken by CNSA 2.0.