4 ms·

been thinking about this a bit. someone just tell me what algo to use and ill start using it now. are the quantum-resistant cryptos significantly slower?

by trueno 6mo ago

d1sxeyes 6mo ago
Basically the idea is use hybrid. AES-GCM-256 or ChaCha20-Poly1305 for symmetric encryption (which is already PQ-safe), and ML-KEM looks set to become the standard for key encapsulation. ML-KEM-768 is fast as an algorithm, faster than X25519 in terms of pure computation, but uses large keys, so has higher overheads on small payloads. Most of the time, they’re about equal, or the absolute time is so slow it doesn’t matter. Most folks now are doing hybrid ML-KEM and X25519 to guard against undiscovered flaws in ML-KEM.
- purplehat_ 6mo ago
  For people reading this, you may want to know the the NSA is allegedly trying to weaken hybrid ML-KEM and X25519 down to just ML-KEM. This is a good thing to pay attention to! Here is a 6-part article about the topic: https://blog.cr.yp.to/20251004-weakened.html https://blog.cr.yp.to/20251004-weakened.html
  - deleted 6mo ago
    [deleted]
  - throw0101a 6mo ago
    > Here is a 6-part article about the topic: https://blog.cr.yp.to/20251004-weakened.html https://blog.cr.yp.to/20251004-weakened.html * https://news.ycombinator.com/item?id=45477206 https://news.ycombinator.com/item?id=45477206 * https://news.ycombinator.com/item?id=45477206#unv_45477799 https://news.ycombinator.com/item?id=45477206#unv_45477799 See various "NSA and IETF": * https://news.ycombinator.com/from?site=cr.yp.to https://news.ycombinator.com/from?site=cr.yp.to
  - tptacek 6mo ago
    I haven't met a single cryptographer who takes this series of posts seriously and if you have I'd love to talk to them.
  - trueno 6mo ago
    is this insinuating that we, collectively, are not 100% confident that ML-KEM on it's own is going to be enough & deduct that the NSA wants the omission of X25519 as sort of a backdoor possibility?
- cube2222 6mo ago
  It’s worth noting that e.g. the Go stdlib has this hybrid construction built-in via crypto/hpke.
  - trueno 6mo ago
    thank you!!! i shall be using this immediately
- d1sxeyes 6mo ago
  So low not so slow
- trueno 6mo ago
  this is great, thanks. i'm a little lost on where I even need to apply this in my own work. for the most part I can think of like a small handful of places where i just symmetrically encrypt at rest, im guessing those should be updated. but for other things, i guess theres going to be a lot of waiting for a platform i dont control for instance to update it's support for things like private/public key authentication and more. i understand openssl supports a lot of these pq methods now, trying to gauge how much of a head start i can reasonably get. > ChaCha20-Poly1305 ha! i ran into this when looking at the source for yaak (guy who made the insomnia rest client who's now making yaak). i never got to the bottom of how it worked.
  - d1sxeyes 6mo ago
    > for the most part I can think of like a small handful of places where i just symmetrically encrypt at rest Current best practices for symmetric encryption are considered PQ-safe (provided your key length is long enough). The real question the above algorithms solve is how do you safely share the key for the symmetric encryption. That’s where X25519 and ML-KEM come in. X25519 is not PQ-safe, but it is very well studied and considered robust. ML-KEM is PQ-safe, but new, and not as well tested/audited.
purplehat_ 6mo ago
I believe ML-KEM is the standard algorithm for post-quantum asymmetric encryption. I think it's slower mainly because there's not good hardware support, but it shouldn't be a big deal because most encryption is hybrid where you only use the asymmetric crypto briefly to share a secret you can use for symmetric cryptography. ML-KEM based on a lattice problem called "Learning With Errors", and there are similar lattice-based algorithms which have no known quantum speedup. Most traditional asymmetric encryption algorithms are based on number-theoretic assumptions like the discrete logarithm problem or the RSA assumption, which are broken by Shor's algorithm. Symmetric cryptography (AES and SHA hash functions) are post-quantum resistant for now. Grover's algorithm technically cuts their asymptotic security in half, but that doesn't parallelize, so practically there is no known good quantum attack, and cryptographers and standards agencies tend to not worry about that. You can keep using those. [edit: according to the sister comment posted simulataneously ML-KEM is faster than X25519. good to know!]
upofadown 6mo ago
For something like PGP, any performance difference wouldn't matter. There is one message and the key agreement is done once. As long as things are fast enough to be imperceptible to the user we are fine.

been thinking about this a bit. someone just tell me what algo to use and ill start using it now. are the quantum-resistant cryptos significantly slower?

by trueno 6mo ago

been thinking about this a bit. someone just tell me what algo to use and ill start using it now. are the quantum-resistant cryptos significantly slower?

d1sxeyes 6mo ago

Basically the idea is use hybrid. AES-GCM-256 or ChaCha20-Poly1305 for symmetric encryption (which is already PQ-safe), and ML-KEM looks set to become the standard for key encapsulation. ML-KEM-768 is fast as an algorithm, faster than X25519 in terms of pure computation, but uses large keys, so has higher overheads on small payloads. Most of the time, they’re about equal, or the absolute time is so slow it doesn’t matter. Most folks now are doing hybrid ML-KEM and X25519 to guard against undiscovered flaws in ML-KEM.

purplehat_ 6mo ago
For people reading this, you may want to know the the NSA is allegedly trying to weaken hybrid ML-KEM and X25519 down to just ML-KEM. This is a good thing to pay attention to! Here is a 6-part article about the topic: https://blog.cr.yp.to/20251004-weakened.html https://blog.cr.yp.to/20251004-weakened.html
- deleted 6mo ago
  [deleted]
- throw0101a 6mo ago
  > Here is a 6-part article about the topic: https://blog.cr.yp.to/20251004-weakened.html https://blog.cr.yp.to/20251004-weakened.html * https://news.ycombinator.com/item?id=45477206 https://news.ycombinator.com/item?id=45477206 * https://news.ycombinator.com/item?id=45477206#unv_45477799 https://news.ycombinator.com/item?id=45477206#unv_45477799 See various "NSA and IETF": * https://news.ycombinator.com/from?site=cr.yp.to https://news.ycombinator.com/from?site=cr.yp.to
- tptacek 6mo ago
  I haven't met a single cryptographer who takes this series of posts seriously and if you have I'd love to talk to them.
- trueno 6mo ago
  is this insinuating that we, collectively, are not 100% confident that ML-KEM on it's own is going to be enough & deduct that the NSA wants the omission of X25519 as sort of a backdoor possibility?
cube2222 6mo ago
It’s worth noting that e.g. the Go stdlib has this hybrid construction built-in via crypto/hpke.
- trueno 6mo ago
  thank you!!! i shall be using this immediately
d1sxeyes 6mo ago
So low not so slow
trueno 6mo ago
this is great, thanks. i'm a little lost on where I even need to apply this in my own work. for the most part I can think of like a small handful of places where i just symmetrically encrypt at rest, im guessing those should be updated. but for other things, i guess theres going to be a lot of waiting for a platform i dont control for instance to update it's support for things like private/public key authentication and more. i understand openssl supports a lot of these pq methods now, trying to gauge how much of a head start i can reasonably get. > ChaCha20-Poly1305 ha! i ran into this when looking at the source for yaak (guy who made the insomnia rest client who's now making yaak). i never got to the bottom of how it worked.
- d1sxeyes 6mo ago
  > for the most part I can think of like a small handful of places where i just symmetrically encrypt at rest Current best practices for symmetric encryption are considered PQ-safe (provided your key length is long enough). The real question the above algorithms solve is how do you safely share the key for the symmetric encryption. That’s where X25519 and ML-KEM come in. X25519 is not PQ-safe, but it is very well studied and considered robust. ML-KEM is PQ-safe, but new, and not as well tested/audited.

purplehat_ 6mo ago

I believe ML-KEM is the standard algorithm for post-quantum asymmetric encryption. I think it's slower mainly because there's not good hardware support, but it shouldn't be a big deal because most encryption is hybrid where you only use the asymmetric crypto briefly to share a secret you can use for symmetric cryptography. ML-KEM based on a lattice problem called "Learning With Errors", and there are similar lattice-based algorithms which have no known quantum speedup. Most traditional asymmetric encryption algorithms are based on number-theoretic assumptions like the discrete logarithm problem or the RSA assumption, which are broken by Shor's algorithm. Symmetric cryptography (AES and SHA hash functions) are post-quantum resistant for now. Grover's algorithm technically cuts their asymptotic security in half, but that doesn't parallelize, so practically there is no known good quantum attack, and cryptographers and standards agencies tend to not worry about that. You can keep using those. [edit: according to the sister comment posted simulataneously ML-KEM is faster than X25519. good to know!]

upofadown 6mo ago

For something like PGP, any performance difference wouldn't matter. There is one message and the key agreement is done once. As long as things are fast enough to be imperceptible to the user we are fine.