Re: [CFRG] NSA vs. hybrid

["Blumenthal, Uri - 0553 - MITLL" <[e-mail]>]

Hybrid *with what* in the past decades? 

 

I’ll constrain myself to Key Agreement algorithms (in some form – i.e., RSA is more of a Key Encapsulation, but…).

 

Given that the following algorithms have been around for at least 25 years: RSA, DH(E) (or El Gamal), ECDH(E), NTRU (published in 1996), I’d expect to see at least some combinations of the above. By 2010, only NTRU was still patented – and patents did not stop people from using RSA and ECC (though IETF – correctly – did not embrace them until their patents expired).

 

The backup algorithm has to plausibly be an actual improvement - historically any lowered confidence in RSA only led to greater key lengths, because that was the option that was understood. Performance issues ruled out most hybrid options and there were no obvious secondary or substitute algorithm (especially due to patent issues). 

 

Respectfully disagree. Performance was fairly comparable, so at worst it would’ve doubled the key exchange duration – probably the same effect as increasing RSA key size. As for obvious secondary or substitute – to me the most obvious choice would be an algorithm from “another” class: if your main algo relies on factoring – pick discrete log-based to back it up, or Lattice-based…

 

PQ algorithms simply haven't had enough cryptoanalysis in the past decades for us to be confident in them, so the value proposition was missing. 

 

I’m asking why the current Classic algorithms have not been paired using the same approach – as they have been around from 10 to 25 years longer than, e.g.,  NTRU. 

 

The point is IMO, what is the reason after all for any PQ algorithm?

It’s all about extremely sensitive applications which 1.) could not even tolerate the extremely low risk that a quantum attack on classical crypto becomes practical and 2.) are willing to tolerate the large penalties.

 

Respectfully disagree on all of the above. (1) I do not consider CRQC to be “extremely low risk” – not for the data that must remain secure for a long time. (2) Some of my applications are pretty sensitive, but they are not able (nor willing) to tolerate large penalties.

 

For such a high security application one MUST really take all available mitigation strategies for even the tiniest identified risk IMHO. For instance, I'd put that as a must for our country's embassy communication.

 

Apparently, this is not how things are designed and deployed. I guess it boils down to how much the designers trust their algorithms – but I challenge you to point me at one instance where for security reasons the application uses a Hybrid approach (even symmetric crypto 😊).



And as there is evidence that there IS a risk with any newly implemented crypto primitive, such a high security application needs everything for being on the safe side.

 

Please define “new”. AES (symmetric, granted) is “newer” than NTRU .



Putting it the other way round. Any actual application that does not need to bother about the risk coming with the newer PQ algorithms could stick with classical crypto, IMHO, and help saving our planet's resources by consuming less energy.

 

First, it looks like Lattice-based crypto consumes much less energy than classical, so dropping 3-4 Kb RSA keys would be helpful to save energy. Second – who says that a 70-year-old algorithm is stronger than 25-years-old? Finally, risk is not an absolute static value – it’s the output of an evaluation. I “bother about the risk” very much – but not blindly grasping at whatever’s available (mean no offense or insult). 

And you still did not answer my question: if an “extremely sensitive” applications (in your opinion) cannot rely on one algorithm that’s “only” 20-25 years old – why didn’t people embrace this approach in 1990-ties (ECC + RSA), or 2005-ish (ECC + RSA or NTRU or such), etc. etc.?

 

Den tors 2 dec. 2021 18:40Blumenthal, Uri - 0553 - MITLL <[e-mail]> skrev:

Following your logic, why haven’t we been using Hybrid approach for the last two decades? Are we that confident in infallibility of RSA or ECDH(E)?

Regards,

Uri