Post #958882
2026-04-06 15:14 UTC
Replies (16)
-
@tmcfarlane@toot.community 2026-04-06 15:25
@filippo I'm still firmly in the camp of those believing that QC is largely stock market manipulation and a snake oil fuelled research grant grift... BUT... Equally, if we have the post-QC crypto math, it only makes sense to use it. I don't see thee downside.
-
@jornfranke@social.anoxinon.de 2026-04-06 17:47
@filippo Both algorithms have not been extensively tested and analysed. It could be a significant higher risk that they are broken on classical computers than there is a quantum computer that can do what it stated by the papers. Instead of having quantum computer validating this risk in practice they only work on artificial irrelevant problems (not actually trying to break keys). It would be good to see some real case (even small) where they try do it - this would help to understand the risk.
-
@gimulnautti@mastodon.green 2026-04-06 18:23
@filippo Can’t wait for the first quantum attack on cryptocurrency. The minute North Korea gets their hands on a large enough quantum computer, that one’s happening.
-
@kitkat_blue@mastodon.social 2026-04-06 19:09
@filippo Considering the stakes, combined with the scope of resources some superpowers possess, plus the "disclose this and it might cost you your _life_" level of "nda" they enforce, I wouldn't count on "a few years". Might already be here? I suspect anyone who might have the actual info as to what the state-of-the-art crypto-breaking capabilities are at the level of a military superpower, they certainly aren't in a position to talk openly about it.
-
@neverpanic@chaos.social 2026-04-06 19:36
@filippo Couldn't agree more with "the bet is 'are you 100% sure a CRQC will NOT exist in 2030?'" — and I'd also add the operational perspective: "are you 100% sure you've found and replaced every Debian oldoldstable and RHEL 8 box that doesn't support PQC by 2030?"
-
@agreeable_landfall@mastodon.social 2026-04-06 20:51
@filippo @robpike Here's an NSA publication on this topic, from 10 years ago. What I love about this is how they describe their requirements: they have to field systems and guarantee their security for 30 years into the future. https://archive.org/details/cnsa-suite-and-quantum-computing-faq/mode/2up
-
@arianvp@functional.cafe 2026-04-06 22:02
@filippo What about WebAuthn, Passkeys, etc? I don't see any movement in that side of the pond. Just as we are convincing everyone to switch to them
-
@timbray@cosocial.ca 2026-04-06 22:34
@filippo I thought the hybrid scenario was if ML-KEM is broken conventionally?
-
@ohir@social.vivaldi.net 2026-04-06 22:35
@filippo > In symmetric encryption, we don’t need to do anything, thankfully Ok. So the IoT garden must rewind to the Kerberos or physical provisioning. I can't imagine lattices on small silicon yet. Thank you, Filippo.
-
@jeffcliff@shitposter.world 2026-04-06 22:54
@filippo @sejaques
-
@edwintorok@discuss.systems 2026-04-06 23:20
@filippo I still think hybrid is the way to go. PQ crypto algorithms and their implementations are still very new, with undiscovered flaws. If you use hybrid and PQ is broken by a bug or flaw, no problem, you still have the same protection or better than the classical one. Even when quantum computers exist you'd have to break both the classical one (with a quantum computer) and the PQ one (with an implementation flaw, or mathematical breakthrough). If you deploy only PQ and a flaw is found you are *worse* than classical, depending on how bad the flaw is you might not be much better from transmitting in plain text. IOW a PQ crypto algoritm protects against an attack from a machine which doesn't yet exist. Deploying it standalone makes you vulnerable against a bug that doesn't yet exist. *But* we've seen a steady stream of bugs in OpenSSL, and it is very likely that there will be one in the PQ implementation too. I think it is more likely that such a bug is discovered before a quantum computer is built that is capable of a practical attack. For example there could be side channel attacks if you forget to implement protections similar to RSA blinding (constant time CPU instructions are not side-channel free, see latest Hertzbleed attack from 2025 about remote power analysis leaks). And there probably plenty of other "classical" attacks that will work on PQ algorithms too, since they execute on a classical computer... Of course implementation flaws in a classical+PQ hybrid could be worse off than just classical too (e.g. some C memory bug), but that might be an acceptable risk. I'm not sure what the best ordering for a hybrid would be, but I guess PQ encryption first, then classical? So you always have to break the classical first (which won't be instant, even with quantum computers). There is of course a performance cost, but AFAICT encryption isn't really the bottleneck in TLS, from some testing with 'curl' and 'stunnel' they achieve much lower speeds than what 'openssl speed' reports, so increasing encryption time may not affect overall time that much.
-
@ahpadt@mastodon.online 2026-04-07 14:03
@filippo The references generally discuss the matter in form of theoretical models. Having an engineers theory v practice mindset, I question whether there is any correlation between advances in these theoretical models and actual, physical quantum computers that dont’t solely exist in highly controlled lab enviroments?
-
@troed@swecyb.com 2026-04-07 18:40
@filippo Is anything pointing to actual quantum computers being made? Dr Hossenfelder has made a few videos on the topic that at least convinced me they're likely never going to be able to scale as much as needed.
-
@timnewsham@mastodon.social 2026-04-08 06:21
@filippo longbet?
-
@ShadSterling@mastodon.social 2026-04-09 16:36
@filippo all I see there is a claim that some classical methods can be broken with only 10^4 qbits, not a claim that a working quantum computer with even 10^3 will be within reach on any particular timeline. Without having enough qbits, how does that suggest it will be broken soon?
-
@Curve25519@infosec.exchange 2026-04-11 10:42
@filippo I am inclined to agree with @djb and to assume the NSA is pulling a DES stunt again [1]. Call me paranoid, but it seems like safer bet. In your blog you mention that "hybrid key exchange is reasonably easy" but hybrid authentication is not. I am way out-of-the-loop on this, could you point me to an explanation on why hybrid authentication is hard(er)? [1]: https://blog.cr.yp.to/20251004-weakened.html