Re: [Cfrg] Fwd: I-D Action: draft-yonezawa-pairing-friendly-curves-01.txt

["Blumenthal, Uri - 0553 - MITLL" <[e-mail]>]

On 4/1/19, 2:30 PM, "Dan Brown" <[e-mail]> wrote:

    > The topic of non-PQ crypto's value applies to other CFRG drafts, such as PAKEs, VRFs, Oblivious functions, etc., so maybe this discussion should be taken outside this thread?

+1
    
    > Non-PQ crypto still seems worthwhile to me, mainly because I estimate the chance of a practical
   > ECC-breaking quantum computer to be low, e.g. 2^(-10),

I don't know enough to agree or argue with your estimation. Would you mind explaining the reasons behind it?

   > ...yet still high enough to warrant a hybrid of PQ and non-PQ crypto, e.g. McEliece + ECC. (See further below.)
    
+1. Hybrid approach is probably it. Depending on what kind of performance we'd get from pure PQC compared to hybrid, and whether hybrid would preserve the non-PQ capabilities while raising the bar for quantum-based attacks.

    >> -----Original Message-----
    >> Re. (2) and (3): sure, but irrelevant with regard to the main question - is it
    >> worth developing (for deploying later, as there's an inevitable lag) non-
    >> quantum-resistant crypto now?
    >
    > It would be smart to answer these types questions with quantified support, but all I
    > get so far is the naïve estimates below. (Presumably, experts have already documented
    > more sophisticated reasoning, maybe see ia.cr/2015/1018).

I do not understand the ECC-related reasoning in that paper by Koblitz and Menezes. Perhaps you can explain it for me? What I read there is: "NSA backdoored EC-DRBG, but they could not break ECC. Therefore, despite themselves promoting ECC and defining it as their mandatory standard, they are now trying to get people off ECC and onto something weaker, using Quantum threat as a prod". 
    
   > For simplicity, consider any crypto as broken or not (at some attack cost and success rate), and then 
   > compare 3 alteratnives: ECC, McEliece (McC), and their hybrid (in the strongest link sense)....

I personally would prefer Isogenies-based approach, otherwise we're probably on the same page.