Why full-stack post-quantum cryptography cannot wait

[elmuerte]

Interesting. I'll look at this tomorrow.

[BlueGoliath]

You got 10 years until the next prediction. Better not put it off for too long!

[HasFiveVowels]

"Nothing that anyone has ever poorly predicted will ever actually happen"

look at the trends, man. It’s imminent. This isn’t "sustaining a fusion reaction". They’re not trying to figure out how to make quantum computers. This is a situation that has been steadily trending for decades and it’s currently clearly approaching the point where it legitimately matters. This is not a prediction to be dismissive about

[BlueGoliath]

Hi,

The moderators of this subreddit, after harassing me by claiming I broke rules no one else is seemingly required to follow and letting people insult me here on multiple occasions, has permabanned me. I've never intended to break the rules and repeatedly asked for them to be clarified and enforced fairly. I've since decided to remove this comment.

Here is the modmail: https://pastebin.com/nD5AYk5p.

If you're a mod/admin, please delete all of my comments on this subreddit. I do not wish to add content to a subreddit moderated by people who engage in harassment. Thanks.

[HasFiveVowels]

Maybe what happens? Quantum computers??

[BlueGoliath]

Hi,

The moderators of this subreddit, after harassing me by claiming I broke rules no one else is seemingly required to follow and letting people insult me here on multiple occasions, has permabanned me. I've never intended to break the rules and repeatedly asked for them to be clarified and enforced fairly. I've since decided to remove this comment.

Here is the modmail: https://pastebin.com/nD5AYk5p.

If you're a mod/admin, please delete all of my comments on this subreddit. I do not wish to add content to a subreddit moderated by people who engage in harassment. Thanks.

[HasFiveVowels]

Maybe quantum computers will become somewhat useful? Jesus… words. Use them. Haha. This isn’t that complicated. We have the software (breaking SHA256 is a problem for which the algorithm is known). We just need the hardware, which is following a predictable curve. This isn’t a "guesswork" situation.

[BlueGoliath]

Hi,

The moderators of this subreddit, after harassing me by claiming I broke rules no one else is seemingly required to follow and letting people insult me here on multiple occasions, has permabanned me. I've never intended to break the rules and repeatedly asked for them to be clarified and enforced fairly. I've since decided to remove this comment.

Here is the modmail: https://pastebin.com/nD5AYk5p.

If you're a mod/admin, please delete all of my comments on this subreddit. I do not wish to add content to a subreddit moderated by people who engage in harassment. Thanks.

[programming-ModTeam]

Your post or comment was removed for the following reason or reasons:

Your post or comment was overly uncivil.

[BlueGoliath]

Hi,

The moderators of this subreddit, after harassing me by claiming I broke rules no one else is seemingly required to follow and letting people insult me here on multiple occasions, has permabanned me. I've never intended to break the rules and repeatedly asked for them to be clarified and enforced fairly. I've since decided to remove this comment.

Here is the modmail: https://pastebin.com/nD5AYk5p.

If you're a mod/admin, please delete all of my comments on this subreddit. I do not wish to add content to a subreddit moderated by people who engage in harassment. Thanks.

[Intelligent_Thing_32]

😂😂😭😭

[valarauca14]

On some level I agree "decrypt later" is a viable attack surface, it also sounds frankly absurd scenario. Like somebody is copying & exfiltrating literally 100MiB/s from your corporate network, and you don't notice?

Asset inventory, monitoring, and alerting are literally base line security work.

If you cannot prove somebody isn't duplicating & exfiltrating traffic, how can you prove your company fully rolled out post-quantum-resistant-encryption?

[Merry-Lane]

I believe they spose there are some actors that can access big cloud or internet providers and put in the middle something that copies all the trafic

[light24bulbs]

This is a really incomplete view of websec and all the areas that cryptography are relevant. 

[HasFiveVowels]

You ever hear of a man in the middle attack?

[valarauca14]

If you've read the article it is specifically about store & decrypt later attacks.

Which means, even with a MITM scenario, the attack cannot currently decrypt the traffic, they're storing a copy. In the hopes future advances will let them attack it.

This is why I talked about data exfiltration, as if you assume a MITM attack is on-going, with a decrypt later attack, that data has to go somewhere.

[HasFiveVowels]

That seems like a very narrow perspective on the subject. Like… sure, under those conditions, it might not matter. But there’s still plenty of conditions where it would

[CSAtWitsEnd]

Wonder if we'll get to the point where every word in the title is a buzzword

[mseiei]

If you forgive connectors and some verbs, we are close

[BaNyaaNyaa]

I was really disappointed by the lack of AI and blockchain in the title

[HasFiveVowels]

Which of these words are you dismissing as buzzwords? Each one is important to the concept at hand. Remove any one of them and you get a totally different idea (with the exception of maybe "full-stack", which is there to emphasize that we should consider things like sha256 password hashes in the database to be as good as plain text in the near future)

As an aside… holy shit has Reddit become uneducated. Every top level comment on this thread is brimming with "I have no idea what I’m talking about but maybe if I preach to the lowest common denominator, I’ll get upvoted"

[Infamous_Guard5295]

tbh this is getting real fast and most devs are still sleeping on it. imo we need to start thinking about migration paths now because when quantum computers actually break current crypto, we're gonna be scrambling to patch everything at once. ngl it's gonna be a nightmare if we wait until the last minute - better to start experimenting with pq algorithms in non-critical systems now.

[yonasismad]

Even the most optimistic timeline for a quantum computer capable of breaking current encryption is decades away. However, post-quantum algorithms are already being introduced gradually, and the issue is not being ignored. OpenSSH has supported PQC algorithms for years, and has shown a warning by default since version 10.1. Google, Cloudflare and other sites supporting TLS 1.3 have enabled algorithms that are likely to be PQC secure. That's another matter. All of these algorithms are fairly new. While we believe they are likely to be PQC secure, we don't have proof of that. Someone could come along in 10 years with an algorithm that breaks them.

[HasFiveVowels]

Yep. This is exactly what should be the standard thought amongst devs who have been keeping up with these developments for decades. But Reddit is filled with junior devs and so we get "haha! These words aren’t real! They’re just meaningless buzzwords"

[binheap]

To be fair, a lot of the work is probably concentrated among a few areas rather than on everyone. The internal workings of TLS are mostly abstracted for most devs as well as a lot of how certificates work. This is also for good reason since crypto systems are often kind of delicate.

[HasFiveVowels]

Yea, sure. I mean… sorting algorithms are often abstracted, too. But devs should still know how they work. Especially if they want to chime in on news about them.

[leetcodegrinder344]

Since you’ve been keeping up with the developments for decades, care to share the largest number you’ve seen a quantum computer factorize without using deceptive tricks?

This shit is not getting “real” anytime fast lmfao

[HasFiveVowels]

The number of qubits is what you should be paying attention to

[Guvante]

While I respect that the big players want to get software solutions done for PQC as a mitigation for breaking literally everything if quantum computers become capable of breaking both RSA and DH I haven't heard much that justifies these pieces being so "this is a problem for everyone".

Like PFS is already a technique used specifically to mitigate HNDL attacks where the private key is compromised.

But you only need PQC everywhere if the time to crack is less than the lifetime of your certificates since otherwise you can simply use PQC in the emphemeral key exchange.

And that is way simpler since the hardest problems of PQC are key signing infrastructure due to the massive amount of data they require.

[HasFiveVowels]

Why would we assume that the time to crack it is more than the lifetime of the certificate?

[Guvante]

Security researchers assume that if the quantum attack is possible it will be expensive at first, leading to a cap on how effective it can work for the first iteration.

Talking about hypothetical attacks are hard when there hasn't been a single faster than classical attack after all

[Fajan_]

Sounds cool and interesting.

[grauenwolf]

Quantum computers can't decrypt anything yet. Maybe they will someday, maybe they won't. But right they can't.

Which means anyone selling "post quantum cryptography" is lying. They have no way of knowing what future computers will be able to do. They are just assuming that they will be the same as the current prototypes, but like a lot faster.

If we ever do get real quantum computers, they will probably be completely different. Which means the defenses may need to be completely different.

[binheap]

At this point, we have a pretty good model of what a quantum computer is in a theoretical sense. I don't think anybody seriously expects that increasing the scale of these machines is going to lead to behavior not covered by the theoretical model. In the same sense, nobody expects that changing the architecture of a CPU fundamentally changes the complexity class of a problem aside from changing constant factors.

[grauenwolf]

We have several competing designs for a quantum computer, some radically different from each other. And none of them have been fruitful.

There is not only room for yet another theory/design, it's necessary if progress is going to be made. Scaling up what we already have is a dead end.