Re: [CFRG] [EXTERNAL] Re: NSA vs. hybrid

[Mike Ounsworth <[e-mail]>]

> As has been noted, so has NTRU gone through a good amount of review, even more perhaps than Rinjdael by this point in the competition for AES.

I'm probably gonna embarrass myself, but here goes ... The argument that I've heard made is that there's a quantum leap (pun intended) between the complexity of the mathematics of RSA/ECC and NTRU. You can mostly wrap your brain around RSA if your highschool teaches modular arithmetic, and the attacks if you take 2nd year uni group theory. ECC also 2nd year group theory. Lattices, LWE, R-LWE, and especially module-LWE are this esoteric combination of rings, fields, and linear algebra that requires a very specific trajectory of graduate studies (likely over-simplified, apologies in advance).

I took this note during Steven Galbraith's keynote at PQCrypto2016:
"There are only a dozen people in the world (2 in the room) who are experts in all the branches of math and algorithm theory that go into lattice problems, so that poses a big problem in predicting the number of bits of security that these things offer."
(talk recording: https://youtu.be/xpBEgT9xyk8?t=520)

I am most certainly not one of those experts qualified to have an opinion, and I know the situation has improved since 2016, but either way I think NTRU, ECC, and Rijndael are not directly comparable in terms of how "hours of public effort" translate to "confidence".

---
Mike Ounsworth

-----Original Message-----
From: CFRG <[e-mail]> On Behalf Of Richard Outerbridge
Sent: December 8, 2021 1:00 AM
To: Loganaden Velvindron <[e-mail]>
Cc: CFRG <[e-mail]>
Subject: [EXTERNAL] Re: [CFRG] NSA vs. hybrid

WARNING: This email originated outside of Entrust.
DO NOT CLICK links or attachments unless you trust the sender and know the content is safe.

______________________________________________________________________
On 2021-12-08 (342), at 01:01:18, Loganaden Velvindron <[e-mail]> wrote:

> On Tue, Dec 7, 2021 at 4:42 AM Martin Thomson <[e-mail]> wrote:
>>
>> On Tue, Dec 7, 2021, at 11:27, Blumenthal, Uri - 0553 - MITLL wrote:
>>> For sensitive data, problem (1) is relevant now - because, as you
>>> said, ciphertexts could be recorded now and broken/decrypted
>>> decade(s) later, when CRQC is available. Hybrid won't help here (and
>>> those who don't expect CRQC to arrive, can stay with ECC).
>>
>> I'm sorry, is that right?  Are you asserting that a hybrid key exchange can be broken later?  I was under the impression that if I paired ECC with a PQ algorithm (and didn't mess it up) I could get the best of the two, assuming that the KDF and AEAD and whatnot are also OK.
>>
> I agree with Martin. ECC implementations have gone through a good
> amount of review. From an engineering point of view, it is safer to
> pair with a PQ implementation to be on the safe side.

As has been noted, so has NTRU gone through a good amount of review, even more perhaps than Rinjdael by this point in the competition for AES.

Anyone see any serious objection to adoption (it’s already de facto)?
__outer

_______________________________________________
CFRG mailing list
[e-mail]
https://urldefense.com/v3/__https://www.irtf.org/mailman/listinfo/cfrg__;!!FJ-Y8qCqXTj2!PeBU3jsCIWp69Veg93PAEmFOTFBs-OzdmMra1UcsT_2I2G-F5pobk90n5uJcMiGF8sSx$
Any email and files/attachments transmitted with it are confidential and are intended solely for the use of the individual or entity to whom they are addressed. If this message has been sent to you in error, you must not copy, distribute or disclose of the information it contains. Please notify Entrust immediately and delete the message from your system.