Re: [Cfrg] Fwd: I-D Action: draft-yonezawa-pairing-friendly-curves-01.txt

[Damien Miller <[e-mail]>]

On Tue, 2 Apr 2019, Peter Gutmann wrote:

> Björn Haase <[e-mail]> writes:
> 
> >We know that the cost of conventional attacks is low and many applications
> >are actually "worth" the effort of an attack.
> 
> Another thing about PQC is that all of this is entirely new crypto that we
> have no experience in using.  We've had decades of experience with using
> PreQC, and have mostly managed to get it right (a lot of the attacks being
> performed were known about years ago but were ignored until someone published
> an attack paper with accompanying tools and newsworthy name, and even then
> there's a huge amount of code in PreQC crypto designed specifically to prevent
> entire classes of attacks), while we have zero experience with using PQC.
> Which means we're going to see years if not decades of new attacks, or the
> same old attacks that were fixed in PreQC implementations, popping up with
> PQC.  It's quite possible that PQC will make us a lot *less* secure, if QC
> never really happens but the expected vulnerabilities in using PQC do.

If anything this prediction (with which I agree) heightens the need for
strong and performant preQC algorithms, so they may be (ahem) paired
with the postQC algorithms to ensure that the combination is resistant
to attack in at least the classical setting.

-d