Re: [Cfrg] Fwd: I-D Action: draft-yonezawa-pairing-friendly-curves-01.txt

In short, the problem is that one group of people accepts the risks for another group of people. 

As one of back officials said in a private discussion: "Your risk is always lower than our cost."

Regards,
Uri

Sent from my iPhone

> On Apr 3, 2019, at 10:48, Watson Ladd <watsonbladd@gmail.com> wrote:
> 
>> On Wed, Apr 3, 2019 at 4:29 AM William Whyte <wwhyte@onboardsecurity.com> wrote:
>> 
>> Hi Peter,
>> 
>>>> Another thing about PQC is that all of this is entirely new crypto that we
>> have no experience in using.  We've had decades of experience with using
>> PreQC, and have mostly managed to get it right (a lot of the attacks being
>> performed were known about years ago but were ignored until someone published
>> an attack paper with accompanying tools and newsworthy name, and even then
>> there's a huge amount of code in PreQC crypto designed specifically to prevent
>> entire classes of attacks), while we have zero experience with using PQC.
>> 
>> This is an argument for being cautious about deploying PQC. It's not an argument
>> that it's a good idea to develop new PreQC primitives. If anything, it's an argument
>> against that.
> 
> There are protocols that only work with new primitives. Some people
> are willing to accept the risk.
> What's the problem?
> 
>> 
>> Cheers,
>> 
>> William
>> 
>> 
>>> On Tue, Apr 2, 2019 at 7:57 PM Peter Gutmann <pgut001@cs.auckland.ac.nz> wrote:
>>> 
>>> Björn Haase <bjoern.m.haase@web.de> writes:
>>> 
>>>> We know that the cost of conventional attacks is low and many applications
>>>> are actually "worth" the effort of an attack.
>>> 
>>> Another thing about PQC is that all of this is entirely new crypto that we
>>> have no experience in using.  We've had decades of experience with using
>>> PreQC, and have mostly managed to get it right (a lot of the attacks being
>>> performed were known about years ago but were ignored until someone published
>>> an attack paper with accompanying tools and newsworthy name, and even then
>>> there's a huge amount of code in PreQC crypto designed specifically to prevent
>>> entire classes of attacks), while we have zero experience with using PQC.
>>> Which means we're going to see years if not decades of new attacks, or the
>>> same old attacks that were fixed in PreQC implementations, popping up with
>>> PQC.  It's quite possible that PQC will make us a lot *less* secure, if QC
>>> never really happens but the expected vulnerabilities in using PQC do.
>>> 
>>> In fact I'll make this prediction now:
>>> 
>>>  Likelihood of successful attacks due to QC: Epsilon.
>>>  Likelihood of successful attacks due to use of PQC over PreQC: 100.0%.
>>> 
>>> (the second figure should actually be much higher than 100%, because there'll
>>> be many, many of them, not just one).
>>> 
>>> Peter.
>>> 
>>> _______________________________________________
>>> Cfrg mailing list
>>> Cfrg@irtf.org
>>> https://www.irtf.org/mailman/listinfo/cfrg
>> 
>> 
>> 
>> --
>> 
>> ---
>> 
>> I may have sent this email out of office hours. I never expect a response outside yours.
>> _______________________________________________
>> Cfrg mailing list
>> Cfrg@irtf.org
>> https://www.irtf.org/mailman/listinfo/cfrg
> 
> 
> 
> -- 
> "Man is born free, but everywhere he is in chains".
> --Rousseau.
> 
> _______________________________________________
> Cfrg mailing list
> Cfrg@irtf.org
> https://www.irtf.org/mailman/listinfo/cfrg

Re: [Cfrg] Fwd: I-D Action: draft-yonezawa-pairing-friendly-curves-01.txt

Attachment: smime.p7s