3 ms·

Here’s what I’m not following in general about the Post Quantum encryption studies. Don’t we already just use the certificates to just negotiate the final encr

Here’s what I’m not following in general about the Post Quantum encryption studies. Don’t we already just use the certificates to just negotiate the final encryption keys? Wouldn’t a quantum computer still crack the agreed upon keys without the exchange details?

mtoner23 1y ago
No the agreed upon keys are symmetric encryption keys with like an AES cipher and we don't have any reason to believe the current encryption there is easier to calculate with a quantum computer
- itopaloglu83 1y ago
  Okay, it makes some sense now. I always assumed that quantum computing would make any encryption scheme less secure, but that’s not the case.
deleted 1y ago
[deleted]
NoahZuniga 1y ago
While quantum computing weakens AES encyption, AES 256 bit can't be cracked by quantum computers.
- MangoToupe 1y ago
  Not practically, anyway, and even with absurd advances we can just grow the key sizes.
- bwesterb 1y ago
  AES-128 also can't be cracked by quantum computers.
mcpherrinm 1y ago
Yes, the rest of the cryptography needs to be PQ-secure as well. But that's largely already true: The key exchange is now typically done with X25519MLKEM768, a hybrid of the traditional x25519 and ML-KEM-768, which is post-quantum secure. The exchanged keys typically AES-128 or AES-256 or ChaCha20. These are likely to be much more secure against quantum computers as well (while they may be weakened, it is likely we have plenty of security margin left). Changing the key exchange or transport encryption protocols however is much, much easier, as it's negotiated and we can add new options right away. Certificates are the trickiest piece to change and upgrade, so even though Q-day is likely years away still, we need to start working on this now. Upgrading the key exchange has already happened because of the risk of capture-now, decrypt-later attacks, where you sniff traffic now and break it in the future.
- itopaloglu83 1y ago
  > Changing the key exchange or transport encryption protocols however is much, much easier, as it's negotiated and we can add new options right away. So that’s a good point. We can quickly add new encryption protocols after the point things are negotiated in the connection, but adding something new or entirely replacing the certificate system or even just the underlying protocols is a big deal.
- jcgl 1y ago
  > The key exchange is now typically done with X25519MLKEM768, a hybrid of the traditional x25519 and ML-KEM-768, which is post-quantum secure. How "typical" are you suggesting this is? Honestly, it's the first I'd heard of this being done at all in the wild (not that I'm an expert). Peeking around a smattering of random websites in my browser, I'm not seeing it mentioned at all.
throwaway89201 1y ago
> Don’t we already just use the certificates to just negotiate the final encryption keys? No, since forward secret key agreement the certificate private key isn't involved at all in the secrecy of the session keys; the private key only proves the authenticity of the connection / the session keys.
- itopaloglu83 1y ago
  I meant to say agreed upon encryption protocol, not keys. Certificates are commonly used to negotiate a symmetric key which I presumed would be vulnerable to quantum computing as well, but apparently AES has some more buffer and also it’s easier to add new negotiated protocols.

mtoner23 1y ago

No the agreed upon keys are symmetric encryption keys with like an AES cipher and we don't have any reason to believe the current encryption there is easier to calculate with a quantum computer

itopaloglu83 1y ago
Okay, it makes some sense now. I always assumed that quantum computing would make any encryption scheme less secure, but that’s not the case.

deleted 1y ago

[deleted]

NoahZuniga 1y ago

While quantum computing weakens AES encyption, AES 256 bit can't be cracked by quantum computers.

MangoToupe 1y ago
Not practically, anyway, and even with absurd advances we can just grow the key sizes.
bwesterb 1y ago
AES-128 also can't be cracked by quantum computers.

mcpherrinm 1y ago

Yes, the rest of the cryptography needs to be PQ-secure as well. But that's largely already true: The key exchange is now typically done with X25519MLKEM768, a hybrid of the traditional x25519 and ML-KEM-768, which is post-quantum secure. The exchanged keys typically AES-128 or AES-256 or ChaCha20. These are likely to be much more secure against quantum computers as well (while they may be weakened, it is likely we have plenty of security margin left). Changing the key exchange or transport encryption protocols however is much, much easier, as it's negotiated and we can add new options right away. Certificates are the trickiest piece to change and upgrade, so even though Q-day is likely years away still, we need to start working on this now. Upgrading the key exchange has already happened because of the risk of capture-now, decrypt-later attacks, where you sniff traffic now and break it in the future.

itopaloglu83 1y ago
> Changing the key exchange or transport encryption protocols however is much, much easier, as it's negotiated and we can add new options right away. So that’s a good point. We can quickly add new encryption protocols after the point things are negotiated in the connection, but adding something new or entirely replacing the certificate system or even just the underlying protocols is a big deal.
jcgl 1y ago
> The key exchange is now typically done with X25519MLKEM768, a hybrid of the traditional x25519 and ML-KEM-768, which is post-quantum secure. How "typical" are you suggesting this is? Honestly, it's the first I'd heard of this being done at all in the wild (not that I'm an expert). Peeking around a smattering of random websites in my browser, I'm not seeing it mentioned at all.

throwaway89201 1y ago

> Don’t we already just use the certificates to just negotiate the final encryption keys? No, since forward secret key agreement the certificate private key isn't involved at all in the secrecy of the session keys; the private key only proves the authenticity of the connection / the session keys.

itopaloglu83 1y ago
I meant to say agreed upon encryption protocol, not keys. Certificates are commonly used to negotiate a symmetric key which I presumed would be vulnerable to quantum computing as well, but apparently AES has some more buffer and also it’s easier to add new negotiated protocols.