4 ms·

This is why strong, asymmetric crypto is necessary. I'm worried that the US government will try to put the genie back in the bottle and go back to the 90's wher

This is why strong, asymmetric crypto is necessary. I'm worried that the US government will try to put the genie back in the bottle and go back to the 90's where strong crypto was considered a munition not suitable for export [0] and when they wanted all "secure" telecommunication to include an NSA backdoor [1]. [0]: http://en.wikipedia.org/wiki/Pretty_Good_Privacy#Criminal_investigation http://en.wikipedia.org/wiki/Pretty_Good_Privacy#Criminal_in... [1]: http://en.wikipedia.org/wiki/Clipper_chip http://en.wikipedia.org/wiki/Clipper_chip

jonmrodriguez 14y ago
Also use much much much longer keys than even a dedicated ASIC manufactured with a futuristic 3 nm technology could crack. Since these spooks are storing the data forever (e.g. at the Stellar Wind facility in Utah), then in a scary future where the USA no longer represents freedom but is instead arresting citizens for political reasons, they could use faster future hardware (even quantum if that's possible) to crack your current data and get you for 30-year-past misdemeanors. I wish the founding fathers were still around to talk some sense into the current "big surveillance" faux-patriots.
- harshreality 14y ago
  Protecting symmetric crypto against quantum computers in the future requires doubling the key length. AFAIK that's the main reason for 256 bit symmetric crypto today. Protecting commonly deployed asymmetric crypto against quantum computers [1] in the future is AFAIK impossible. Shor's algorithm and the ecc/dlp variants turn factoring, dlp, and ecc dlp, into BQP problems. Key lengths to protect against quantum attacks would render rsa, ecdsa, dh, and ecdh much too computationally expensive. There are some alternatives like NTRU (lattice-based crypto) but none are in wide use, and patents don't help that situation. [1] real quantum computers... there is still plenty of skepticism about the capability of d-wave's devices. http://www.scottaaronson.com/blog/?p=954 http://www.scottaaronson.com/blog/?p=954

jonmrodriguez 14y ago

Also use much much much longer keys than even a dedicated ASIC manufactured with a futuristic 3 nm technology could crack. Since these spooks are storing the data forever (e.g. at the Stellar Wind facility in Utah), then in a scary future where the USA no longer represents freedom but is instead arresting citizens for political reasons, they could use faster future hardware (even quantum if that's possible) to crack your current data and get you for 30-year-past misdemeanors. I wish the founding fathers were still around to talk some sense into the current "big surveillance" faux-patriots.

harshreality 14y ago
Protecting symmetric crypto against quantum computers in the future requires doubling the key length. AFAIK that's the main reason for 256 bit symmetric crypto today. Protecting commonly deployed asymmetric crypto against quantum computers [1] in the future is AFAIK impossible. Shor's algorithm and the ecc/dlp variants turn factoring, dlp, and ecc dlp, into BQP problems. Key lengths to protect against quantum attacks would render rsa, ecdsa, dh, and ecdh much too computationally expensive. There are some alternatives like NTRU (lattice-based crypto) but none are in wide use, and patents don't help that situation. [1] real quantum computers... there is still plenty of skepticism about the capability of d-wave's devices. http://www.scottaaronson.com/blog/?p=954 http://www.scottaaronson.com/blog/?p=954