Re: [CFRG] NSA vs. hybrid

[Mike Hamburg <[e-mail]>]

>>  So if someone needs these features today, they will have trouble migrating
>> to a postquantum system.  But they might be able to migrate to a hybrid
>> system with the classical part running in the HSM or in a
>> side-channel-protected way, if this can be done in a way that’s at
>> least as secure as the classical system.
> 
> You are saying - "those who now use HSM, can still use Classic part on HSM and add PQ part in software"? I don't think it would be acceptable: if you embrace PQ - the only real reason seems to be that you really don't want your _today's_ data to become exposed (much?) later, when CRQC arrives. In that case, your combination won't work: CRQC would break the Classic part regardless of HSM. And if one does not worry about data lifetime - then there's no reason to add PQ now.

Yes, but this attack requires the attacker to hack you today to steal your non-HSM postquantum keys, and then also come back with a quantum computer in 10 or 20 years to break the classical components (if the HSM resists the attack).  Similarly with side-channels attacks, the attacker must mount the side-channel attack today on your PQC in order to attack you much later.

This is a much more difficult attack model than “slurp up everything on the internet today, and break inteteresting-seeming things later”.

>> I don’t know if that’s a controlling consideration, but we should
>> at least consider it.
> 
> Consideration-wise, I'd say - not for me. If I have a "secure" box that performs crypto computations (you may call it "HSM" ;), then PQ would go there too. 
> 
> Makes sense?

Sure, PQC should eventually go into the secure box, but that may take longer.  This might prevent people who take security very seriously, such that they need HSMs, from deploying PQC.

Cheers,
— Mike