Re: [CFRG] CFRG and crypto-threatening quantum computers

   "What does CFRG do?"

   In my view it bridges the gap between the academic paper and
the protocol implementation. Its a crucial role that exists
regardless of whether the crypto is QC-susceptible or not.

   Dan.

On 9/17/21 2:56 PM, Riad S. Wahby wrote:
> Hello Uri,
>
> (Changed the subject line since we're pretty off-topic here.)
>
> It seems silly for us to go back and forth point-by-point, especially
> since most of our specific disagreements are minor and definitional.
>
>      (e.g., What does CFRG do? Depends who you ask. From a research
>      cryptographer's point of view the things we're documenting right
>      now---pairing-friendly curves, hashing to curves, etc.---are
>      roughly the same vintage as S/MIME!)
>
>      (e.g., is USG making new quantum-susceptible standards? Well,
>      should we count NIST's adding Ed25519 to FIPS-186?)
>
> The high-level question is whether CFRG should act as if it's all but
> certain that crypto-threatening quantum computers will exist in the
> next few years. I think no; reasonable people can certainly disagree.
> But let's try to avoid spitting contests. We will win by reaching
> consensus, not by saying the cleverest things.
>
> In that vein:
>
> "Blumenthal, Uri - 0553 - MITLL" <uri@ll.mit.edu> wrote:
>>>     This argument does not seem productive: essentially all cryptography
>>>     is based on hardness assumptions that have not been proved or disproved
>>>     (and, given our current knowledge, seem unlikely to be). If we accept
>>>     the above argument, the logical conclusion seems to be "disband CFRG".
>> You equate "make new designs quantum-resistant" with "let's disband CFRG"??? Hmm...
> The argument was: "there is no way to prove or disprove convincingly
> this [security] concern", in the context of constructing crypto-threatening
> quantum computers, implies "make all new designs quantum-resistant."
>
> The point is, this doesn't go nearly far enough: "there is no way
> to prove or disprove convincingly this [security] concern", in the
> context of cryptography more broadly (and given prevailing beliefs
> vis-a-vis complexity theory), implies "give up".
>
> But we both agree that's absurd. So maybe we should rethink the premise
> here.
>
> Cheers,
>
> -=rsw
>
> _______________________________________________
> CFRG mailing list
> CFRG@irtf.org
> https://www.irtf.org/mailman/listinfo/cfrg

-- 
"The object of life is not to be on the side of the majority, but to
escape finding oneself in the ranks of the insane." -- Marcus Aurelius