Re: [Cfrg] New draft on the transition from classical to post-quantum cryptography

[Hugo Krawczyk <[e-mail]>]

I want to highlight the importance of the post-quantum work regardless of
the post-quantum prospects, namely, independently of the predictions and
feasibility of constructing Shor-grade quantum computers.

People claim that we need to move to quantum-resistant crypto now (or in
the near future) since there is information created now that needs to stay
secret for 30-50 (even 100) years. My strong recommendation for such
applications is to NOT use public key (PK) encryption or PK-based online
key exchange to generate encryption keys for this data. Rather exchange
keys offline and onion-encrypt with several symmetric ciphers and
over-sized keys (twice the security parameter).

This recommendation is *independent* of the prospects of quantum
computation (QC) reaching the point in which it can break PK cryptosystems.
It is rather based on the precarious standing of all our public key
algorithms and their potential vulnerabilities to *classical*
cryptanalysis.

Is the probability of ECC and/or RSA being broken by mathematical
cryptanalysis higher or lower than the probability of these systems being
broken by QC in x years?  I don't know. But I do know that while a powerful
quantum computer will not be built overnight, a devastating mathematical
break (of EC or RSA cryptography) could happen in the middle of the night.
All you need is one bright person dreaming the right idea.

So what I am saying is that we need to thank QC for drawing attention to
the need to diversify our algorithms, to build our protocols with algorithm
agility and negotiation, to invest serious funding in researching new
public key mechanisms, particularly in the area of lattice-based
cryptography (where many other benefits are likely to arise), and to make
us all think about how to *really* ensure long-term secrecy. We should have
done all of this without the threat of powerful quantum computers, but
without it we wouldn't have had the attention and funding we now have to
address these most important problems.

So, thanks QC! You are already making our systems more durably secure! Now,
let's not allow the speculations surrounding the feasibility and timing of
QC distract us from the really important task of diversifying PK
Cryptography.  Keep the attention, focus and funding coming.

Hugo