3 ms·
Well. Yes, but currently there are no well tested (ie. recommended by the ITsec community) post-quantum cryptosystems as far as I understand. https://crypto.st
by pas 2y ago
Well. Yes, but currently there are no well tested (ie. recommended by the ITsec community) post-quantum cryptosystems as far as I understand.
https://crypto.stackexchange.com/a/61596 https://crypto.stackexchange.com/a/61596
But ... AES is believed to be quantum-safe-ish, so with perfect forwards secrecy this exact threat can be quite well managed.
The currently best known quantum attack on AES requires a serial computation of "half of key length" (Grover's algorithm ... so if they key is 128 bit long then it requires 2^64 sequential steps)
https://www.reddit.com/r/AskNetsec/comments/15i0nzp/aes256_is_quantum_resistant_for_now/jurxnv7/ https://www.reddit.com/r/AskNetsec/comments/15i0nzp/aes256_i...
- _tk_ 2y agoGoogle uses NTRU-HRSS internally, which seems reasonable. https://cloud.google.com/blog/products/identity-security/why-google-now-uses-post-quantum-cryptography-for-internal-comms?hl=en https://cloud.google.com/blog/products/identity-security/why...
- makeworld 2y agoSignal and Apple both use post-quantum.
- pas 2y agoI read about Signal's double-trouble tactics, but I haven't heard about Apple's. Ah, okay for iMessage, something called PQ3[1], hm, it uses Kyber. And it's also a hybrid scheme, combining ECC. And a lot of peer review. And there's also some formal verification for Signal's PQXDH [2]. Oh, wow, not bad. Thanks! Now let's hope a good reliable sane implementation emerges so others can also try this scheme. (And I'm very curious of the added complexity/maintenance burden and computational costs. Though I guess this mostly runs on the end users' devices, right?) [1] https://security.apple.com/blog/imessage-pq3/ https://security.apple.com/blog/imessage-pq3/ [2] https://github.com/Inria-Prosecco/pqxdh-analysis https://github.com/Inria-Prosecco/pqxdh-analysis