3 ms·
Regev in 2005 was hugely important, but '90s NTRU remains unbroken, and Atjai was 1996. The Suite B thing undercuts your argument! You've managed to establish 2
by tptacek 2mo ago
Regev in 2005 was hugely important, but '90s NTRU remains unbroken, and Atjai was 1996. The Suite B thing undercuts your argument! You've managed to establish 25519's publication the same year as Suite B. Again: Bernstein didn't ask people to run 25519/MODP hybrids.
I think the bigger thing is that a lot of us are older than we realize, and 2005 was a very long time ago --- over 20 years. This is like the distance between Nevermind and Houses of the Holy.
Finally: I'm not letting anybody, including Bernstein, get away with allusions to SIKE as a way of impeaching lattice cryptography. Supersingular isogeny cryptography was moon math, and everybody agreed at the time. It has zero relation to lattice problems. It has zero relation to anything! (Ironically, if it did relate to cryptography in use today, it'd be to elliptic curves).
- vlovich123 2mo agoMy point is not about a specific algorithm or application. I’m talking about the family elliptic curve vs lattice. Bernstein isn’t asking people to run hybrids because the mathematics is simple and well understood. Also Curve25519 is just a specific set of constants for ECDH. The underlying algorithm was already designed and well understood. The main advancement was selecting the constants carefully to be free of side channel attacks and to be fast. If you can’t see how that’s a very different situation I really don’t know how to help you understand the concern.
- tptacek 2mo agoYou know who wouldn't agree that Curve25519 is "just a specific set of constants for ECDH"? The guy who wrote SafeCurves. Also: you've lapsed into talking down all lattices, which leaves you in the position of explaining why Bernstein submitted/sponsored sntrup.
- vlovich123 2mo agoAll I’m saying is that lattices are newer and more complex. Bernstein is proposing a lattice scheme AND saying it should be hybrid. ALSO. The proposal is to replace cyclotomics with Gallois field precisely because they are better understood and easier to construct correctly. > The NTRU Prime project recommends switching from "cyclotomics" to "large Galois groups" to reduce the attack surface in lattice-based cryptography. After this recommendation was published, Gentry's original (STOC 2009) fully homomorphic encryption system was shown to be broken in quantum polynomial time for cyclotomics.
- deleted 2mo ago[deleted]