[Cfrg] Quantum Computing and Crypto Policies

["Dr. Pala" <[e-mail]>]

Hi all,

At the CFRG meeting, I have appreciated the presentation about QC in the 
sense that inspired to think about the future in a more practical way 
(although there was probably not much agreement on how to proceed forward).

I have also been following the conversation about the post-quantum 
computing crypto resistance and I am trying to figure out - given what 
we know about possible quantum computing which, as Tim pointed out 
during the meeting, is still very little - what types of policies can be 
implemented today that would allow us to be a bit more resilient to 
attacks in the post quantum-computing environment (i.e., not being taken 
by surprise since deploying of new crypto can take several years in the 
real world despite the algorithm agility we have in current standards). 
I will try to summarize the two main points:

 1. Symmetric crypto is still relatively secure. Using 256bits keys
    (e.g., AES 256) should provide enough confidentiality for the time
    being (this is already a common practice in the industry as the
    overhead compared to 128bits is negligible) - so we are relatively
    safe here.
 2. Given the physical limitations when it comes to be able to have QC
    with high number of qbits, it seems that when it comes to Asymmetric
    crypto, ECDSA (given the limited number of bits and the
    impossibility to extend the number of bits without defining new
    curves) is the weakest choice compared to RSA with very long keys
    (e.g., 8K or 16K bits keys or even bigger...).

In other words, given this scenario and setting aside considerations 
about signature sizes (although, we have seen an increase in computing 
resources in terms of processing power, bandwidth, and storage it seems 
that signature size is a big concern - AFAIK, mostly driven by IoT and 
similar environments - even more than 10yrs ago! and many WGs are using 
the size argument over the security argument in their specifications and 
suggestions), the more flexible and forward-secure choice would be to 
start using "oversized" RSA keys for asymmetric and for symmetric we can 
keep using AES 256 with relative confidence (assuming, as I said, that 
no new quantum-specific algorithms are discovered...)

Does this summarizes the current situation? Are these (very simplistic) 
considerations correct? Anybody disagree with these statements? Why?

Cheers,
Max

-- 
Massimiliano Pala, PhD
Director at OpenCA Labs
twitter: @openca