HN

Comments (64)

• michaelsmanley
  I just want to comment on how clear I find Filippo Valsorda's writing on this kind of thing. Even for an old dunderhead like me, his mathematics and examples were easy to follow. I really appreciate that kind of clarity in technical writing.
• Menu

  staticassertion
  Is there any reason to believe that Grover's is as good as it gets? I'm on board here, and I think the article caveats that it's a matter of cost, priority, and assumptions. Cool, cool, I'm already using xaes-256-gcm. But I'm just curious if quantum could have new applications for algorithmic analysis, or take advantage of other weaknesses?
• the_data_nerd
  Rotation protects one threat model, not both. A broken signing key five minutes old is one forged-window. Harvested ciphertext in someone's archive does not care when you deleted the session key. Rotate the signer, but put xaes-256-gcm on the payload if you want the bytes safe ten years out.
• Menu

  bob1029
  I think quantum may be practically mitigated with aggressive key rotation in some cases. I've been prototyping an oauth machine-to-machine integration with a banking vendor that has our ecdsa keys rotate every 5 minutes. The keys are scheduled for deletion after 10 minutes. I see no reason I couldn't reduce this to something like 30s/60s. Our counterparty frequently scans our JWKS endpoint for revocation, so in practice an attacker with a quantum computer would need to be very fast if they wanted to break this particular wire agreement the scary way.
• Menu

  rugina
  On one hand I hear that quantum computers will crack factorisation and discrete logarithms, on the other that the max number factorised is 15 and that 21 might not even be feasible.What is going on?
• Menu

  ninjahawk1
  Very good breakdown, if I’m understanding Grover’s algorithm correctly, are you saying essentially that it would require either too much compute or too much time to be feasible but is still much more realistic than a brute force attack?If that’s the case, would the time eventually be basically irrelevant with enough compute? For instance, if what’s now a data center is able to fit in the palm of your hand (comparing early computers that took up rooms to phones nowadays). So if compute is (somehow) eventually able to be incredibly well optimized or if we use something new, like how microprocessors were the next big thing, would that then be a quantum threat to 128-bit symmetric keys?
• Menu

  kd913
  If this is true, I feel teh wifi alliance have a tonne to answer for the ewaste they generate.WPA3 moved from symmetric AES to ECDH which is vulnerable to Quantum. Gonna be a tonne of IOT inverters waste.
• nelox
  Certainty is a wonderful thing
• anon
  undefined
• Strilanc
  Good post. Entirely correct, and well known amongst quantum researchers, but under appreciated in general.Grover attacks are very blatantly impractical. When someone describes Grover-type attacks in the same breath as Shor-type attacks, without caveats, that's a red flag.
• Menu

  daneel_w
  I wonder when the OpenSSH developers will change their stance on Ed448.
• Menu

  TacticalCoder
  Tangentially related but regarding RSA and ECC... With RSA can't we just say: "Let's use 16 384 bit keys" and be safe for a long while?And for ECC, I know many are using the "2 exp 255 - 19" / 25519 for it's unlikely to be backdoored but it's only 256 bits but... Can't we find, say, "2 exp 2047 - 19" (just making that one up) and be safe for a while too?Basically: for RSA and ECC, is there anything preventing us from using keys 10x bigger?
• jeremie_strand
  [dead]
• Menu

  occamofsandwich
  Disconcerting opening. If you want to put hash algorithms in the same category as symmetric keys in this particular case then say so without referring to them as if they are symmetric keys.
• Menu

  rolph
  encryption is not ever to be considered impossible to break.every encryption scheme has at least one way to be decrypted.fidelity of information is one use of encryption, if you apply the solution and get garbage, something is wrong, somewhere.occultation of information is another use, that is commonly abused by extending undue trust. under the proviso that encryption will eventually be broken, you cant trust encryption to keep a secret forever, but you can keep it secret, for long enough that it is no longer applicible to an attack,or slightly askew usecase, thus aggressive rotation of keys becomes desirable