NIST Post-Quantum Cryptography Round 1 Submissions

Re:NIST Post-Quantum Cryptography Round 1 Submissions by exabrial on Wednesday December 27, 2017 @12:01PM (#16016029)

I like to ask dumb questions... So here is one: Are forward secrecy guarantees made by TLS valid in a post-quantum world?

Specifically, say I connect via TLS to a server that uses FS and exchange some information that will be valuable in 150 years. If the entire conversation is recorded at the wire, does quantum computing break this promise? (or have I misunderstood FS completely?)

[ Parent | on HN ]

Re:NIST Post-Quantum Cryptography Round 1 Submissions by modalduality on Wednesday December 27, 2017 @12:11PM (#16016128)

In general forward security involves generating a new key for each conversation with Diffie-Hellman or similar.

According to https://crypto.stackexchange.com/questions/5610/diffie-hellm..., Diffie-Hellman is not post-quantum secure, but https://en.wikipedia.org/wiki/Supersingular_isogeny_key_exch... is a DH alternative that is.

[ Parent | on HN ]

Re:NIST Post-Quantum Cryptography Round 1 Submissions by jgrahamc on Wednesday December 27, 2017 @12:12PM (#16016142)

Which is partly why we wrote and open sourced a SIDH implementation in TLS 1.3: https://blog.cloudflare.com/sidh-go/

[ Parent | on HN ]

Re:NIST Post-Quantum Cryptography Round 1 Submissions by exabrial on Wednesday December 27, 2017 @02:06PM (#16017070)

I <3 cloudflare, you guys are awesome!

[ Parent | on HN ]

Re:NIST Post-Quantum Cryptography Round 1 Submissions by newman314 on Wednesday December 27, 2017 @07:07PM (#16019240)

Do you have any performance numbers for SIDH vs ECDHE?

[ Parent | on HN ]

Re:NIST Post-Quantum Cryptography Round 1 Submissions by grittygrease on Sunday December 31, 2017 @01:09PM (#16041756)

Cloudflare has a Go implementation of SIDH with p751: https://blog.cloudflare.com/sidh-go/

Here’s an overview of the performance from a patch by Armando Faz Hernandez: https://github.com/cloudflare/p751sidh/pull/2

[ Parent | on HN ]

Re:NIST Post-Quantum Cryptography Round 1 Submissions by CiPHPerCoder on Wednesday December 27, 2017 @12:11PM (#16016137)

https://www.fredericjacobs.com/blog/2016/04/07/qc-axolotl/ might be a good place to start answering this question.

If you can break the ECDH, you can figure out the key that was calculated. However, if other unknown data (e.g. past ECDH outputs) is hashed together to generate the key (like Signal does, as a very rough description), it's only post-quantum secure if the adversary ever misses a single message.

Other than weird saved-by-the-bell corner cases, the answer is "No".

[ Parent | on HN ]

Re:NIST Post-Quantum Cryptography Round 1 Submissions by bascule on Wednesday December 27, 2017 @02:33PM (#16017299)

I wrote a blog post about this. tl;dr: no, not unless you were using PQ hard algorithms

https://tonyarcieri.com/imperfect-forward-secrecy-the-coming...

[ Parent | on HN ]

Re:NIST Post-Quantum Cryptography Round 1 Submissions by nokcha on Wednesday December 27, 2017 @12:15PM (#16016179)

>Are forward secrecy guarantees made by TLS valid in a post-quantum world?

No, forward secrecy doesn't apply if the underlying public-key cryptography gets broken (such as by a quantum computer).

[ Parent | on HN ]