“The problem in a nutshell. Surveillance agency NSA and its [UK counterpart] GCHQ are trying to have standards-development organizations endorse weakening [pre-quantum] ECC+PQ down to just PQ.”
Part of this is that NSA and GCHQ have been endlessly repeating arguments that this weakening is a good thing… I’m instead looking at how easy it is for NSA to simply spend money to corrupt the standardization process… The massive U.S. military budget now publicly requires cryptographic “components” to have NSA approval… In June 2024, NSA’s William Layton wrote that “we do not anticipate supporting hybrid in national security systems”…
[Later a Cisco employee wrote of selling non-hybrid cryptography to a significant customer, “that’s what they’re willing to buy. Hence, Cisco will implement it”.]
What do you do with your control over the U.S. military budget? That’s another opportunity to “shape the worldwide commercial cryptography marketplace”. You can tell people that you won’t authorize purchasing double encryption. You can even follow through on having the military publicly purchase single encryption. Meanwhile you quietly spend a negligible amount of money on an independent encryption layer to protect the data that you care about, so you’re actually using double encryption.
A place to discuss privacy and freedom in the digital world.
Privacy has become a very important issue in modern society, with companies and governments constantly abusing their power, more and more people are waking up to the importance of digital privacy.
In this community everyone is welcome to post links and discuss topics related to privacy.
Some Rules
- Posting a link to a website containing tracking isn’t great, if contents of the website are behind a paywall maybe copy them into the post
- Don’t promote proprietary software
- Try to keep things on topic
- If you have a question, please try searching for previous discussions, maybe it has already been answered
- Reposts are fine, but should have at least a couple of weeks in between so that the post can reach a new audience
- Be nice :)
Related communities
much thanks to @gary_host_laptop for the logo design :)
- 0 users online
- 113 users / day
- 519 users / week
- 1.44K users / month
- 4.49K users / 6 months
- 1 subscriber
- 4.3K Posts
- 109K Comments
- Modlog
I think we both agree on the same thing, I comunicated it badly. The better approach is to apply a post-quantun algorithm on top of a classical one, so you are safe against both types of computers. The advantage of this approach is that you need to crack both algorithms at the same time.
NIST seems to prefers a hybrid approach, where a single algorithm is supposedly safe against both classical and quantum computers, leaving you with a single point of failure.
You can always encrypt the payload twice if you want. But really what are you arguing? That every time you encrypt something, you should encrypt it serially with all known encryption algorithms “just in case?” Hell why not do it again just to make sure?
A key component of encryption is efficiency. Most cryptographic processes are going to be occurring billions of times across billions of transactions and involving billions of systems. It’s worthwhile for robust encryption algorithms to be efficient and avoid unnecessary calculations unless those calculations demonstrate some advantage. For example PBKDF2, where the multiple rounds of identical encryption convey a demonstrable increase in time to decrypt via brute-force mechanisms. If the standard is 4096 which it was in 2005, you coming along and saying, but why isn’t it 4097? The CIA is using >4096, therefore that means that 4096 is insecure! Isn’t really understanding why 4096 was chosen to begin with. Additionally no one is stopping you from using one million iterations with key1 and then doing another million rounds with key2.
That’s not what I’m trying to say. I’m not saying apply 1000 classical algos on top of 1000 quantum algos. I’m saying that post-quantum needs to be an extra layer, not a replacement.
This is explained further in the first few sentences of the third link I posted: https://blog.cr.yp.to/20251004-weakened.html. Note the author is an expert in the topic: https://en.wikipedia.org/wiki/Daniel_J._Bernstein
Well I haven’t see the arguement for why Quantum resistent encryption would somehow be weaker to traditional cryptographic techniques. I understand that early “quantum encryption” alogrithms were flawed, and it’ll probably be a long time before we get the DES of Quantum Encryption. But all that means is that we don’t have vetted “strong” quantum encryption techniques yet, and should stick with traditional encryption since quantum encryption isn’t worth it yet. If Quantum encryption becomes worthwhile, we shouldn’t have “traditional encryption”, because it will be obsolete.
If the first cylinder lock was easily bypassed compared to my old reliable wafer lock, then why should I use the cylinder lock at all? Now that cylinder locks are better then wafer locks why should I use a tumbler lock at all? There is no added security by using a wafer lock.
Quantum computers represent a complete paradigmatic. Modern quantum computers beat classical ones on some problems, while still not being able to factor some 2 digit numbers.
A single algorithm would be probable arrive some day, but why risk it right now? The Signal protocol adopted Post-Quantum some years ago. They going for a hybrid, not well tested over several years against classical computers, algorithm, would have been a security disaster.