Re: [CFRG] NSA vs. hybrid

["Blumenthal, Uri - 0553 - MITLL" <[e-mail]>]

>    Not offering hybrid, say NTRU & ECC, in the past put us in this pickle now of 
>    the quantum computer attack risk.

I disagree. 

Back then, similarly to here-and-now, cryptographers could not know whether there'd be a breakthrough in discrete log, or in factoring, or in both (or in SVP). So, a prudent (from your point of view) thing would've been to combine (all of them). Instead, they (correctly, IMHO) decided that it isn't worth doing - the low likelihood of such a breakthrough did not justify that. 

NTRU now has been studied for as long as RSA then, and other Lattice-based algorithms - for as long as ECC then.

I concede that there was almost no FUD back then, compared to now. 

>    Certainly, there are applications where the gains from hybrid are outweighed 
>    by the cost, but also applications where hybrid is worthwhile.
>
>    Hybrid ought to be option, or IETF WGs should use a cost-benefit analysis per 
>    application, the CFRG could help there.

How do you evaluate the benefit? "If algorithm X gets broken, with a probability I've no idea of..."?

>    (Generally, let's learn from our mistakes.

Given that we had no problem caused by "not combining algorithms" so far, I say the mistake is what we're trying to do now.

>    Besides, aren't some users 
>    naturally inclined to expect the Internet to maximally secure their data? ;)

:-) Cuique suum.