Re: [CFRG] NSA vs. hybrid

Firmware singing for long-lived systems, like chips used in cars, falls
under #2, yet the reasoning about relevance and time to worry is the same
as for #1. System built today may be broken 30 years from now, without
possibility to update them.

Fortunately, there is XMSS to solve this problem for firmware signing, and
XMSS should not need a hybrid scheme.

However, I generally support a hybrid scheme for cases like #1, at least as
a "paranoid security" option.

On Mon, Dec 6, 2021 at 4:27 PM Blumenthal, Uri - 0553 - MITLL <
uri@ll.mit.edu> wrote:

> CRQC (Crypto-Relevant Quantum Computer) is a threat in two ways:
> 1. Breaking your key exchange and decrypting your confidential information;
> 2. Forging your digital signature and/or authentication.
>
> For sensitive data, problem (1) is relevant now - because, as you said,
> ciphertexts could be recorded now and broken/decrypted decade(s) later,
> when CRQC is available. Hybrid won't help here (and those who don't expect
> CRQC to arrive, can stay with ECC).
>
> As to (2), it's unclear when we need to start worrying (though, probably,
> not now). Clearly, it's of no advantage to the adversary to forge my
> signature now on a TLS session established 10 years ago. It may well be a
> concern for legal documents - e.g., if somebody 10 years from now forges a
> signature on a mortgage - but I can't evaluate this risk, as I don't have
> enough understanding of the field.
>
> So, "quantum annoyance" is not an answer for me: for short-lived data, I
> don't care at all (for now) - and for long-lived (presumably important)
> data I can't rely on "well, they're busy cracking zillions of somebody
> else's data, and my data's turn may not even come".
> --
> Regards,
> Uri
>
> There are two ways to design a system. One is to make it so simple there
> are obviously no deficiencies.
> The other is to make it so complex there are no obvious deficiencies.
>
>                                                            -  C. A. R. Hoare
> _______________________________________________
> CFRG mailing list
> CFRG@irtf.org
> https://www.irtf.org/mailman/listinfo/cfrg
>