Re: [Cfrg] Fwd: I-D Action: draft-yonezawa-pairing-friendly-curves-01.txt

On Wed, Apr 3, 2019 at 4:29 AM William Whyte <wwhyte@onboardsecurity.com> wrote:
>
> Hi Peter,
>
> >> Another thing about PQC is that all of this is entirely new crypto that we
> have no experience in using.  We've had decades of experience with using
> PreQC, and have mostly managed to get it right (a lot of the attacks being
> performed were known about years ago but were ignored until someone published
> an attack paper with accompanying tools and newsworthy name, and even then
> there's a huge amount of code in PreQC crypto designed specifically to prevent
> entire classes of attacks), while we have zero experience with using PQC.
>
> This is an argument for being cautious about deploying PQC. It's not an argument
> that it's a good idea to develop new PreQC primitives. If anything, it's an argument
> against that.

There are protocols that only work with new primitives. Some people
are willing to accept the risk.
What's the problem?

>
> Cheers,
>
> William
>
>
> On Tue, Apr 2, 2019 at 7:57 PM Peter Gutmann <pgut001@cs.auckland.ac.nz> wrote:
>>
>> Björn Haase <bjoern.m.haase@web.de> writes:
>>
>> >We know that the cost of conventional attacks is low and many applications
>> >are actually "worth" the effort of an attack.
>>
>> Another thing about PQC is that all of this is entirely new crypto that we
>> have no experience in using.  We've had decades of experience with using
>> PreQC, and have mostly managed to get it right (a lot of the attacks being
>> performed were known about years ago but were ignored until someone published
>> an attack paper with accompanying tools and newsworthy name, and even then
>> there's a huge amount of code in PreQC crypto designed specifically to prevent
>> entire classes of attacks), while we have zero experience with using PQC.
>> Which means we're going to see years if not decades of new attacks, or the
>> same old attacks that were fixed in PreQC implementations, popping up with
>> PQC.  It's quite possible that PQC will make us a lot *less* secure, if QC
>> never really happens but the expected vulnerabilities in using PQC do.
>>
>> In fact I'll make this prediction now:
>>
>>   Likelihood of successful attacks due to QC: Epsilon.
>>   Likelihood of successful attacks due to use of PQC over PreQC: 100.0%.
>>
>> (the second figure should actually be much higher than 100%, because there'll
>> be many, many of them, not just one).
>>
>> Peter.
>>
>> _______________________________________________
>> Cfrg mailing list
>> Cfrg@irtf.org
>> https://www.irtf.org/mailman/listinfo/cfrg
>
>
>
> --
>
> ---
>
> I may have sent this email out of office hours. I never expect a response outside yours.
> _______________________________________________
> Cfrg mailing list
> Cfrg@irtf.org
> https://www.irtf.org/mailman/listinfo/cfrg

-- 
"Man is born free, but everywhere he is in chains".
--Rousseau.