Re: [CFRG] CFRG and crypto-threatening quantum computers

On Fri, Sep 17, 2021 at 5:57 PM Riad S. Wahby <rsw@jfet.org> wrote:

> Hello Uri,
>
> (Changed the subject line since we're pretty off-topic here.)
>
> It seems silly for us to go back and forth point-by-point, especially
> since most of our specific disagreements are minor and definitional.
>
>     (e.g., What does CFRG do? Depends who you ask. From a research
>     cryptographer's point of view the things we're documenting right
>     now---pairing-friendly curves, hashing to curves, etc.---are
>     roughly the same vintage as S/MIME!)
>
>     (e.g., is USG making new quantum-susceptible standards? Well,
>     should we count NIST's adding Ed25519 to FIPS-186?)
>
> The high-level question is whether CFRG should act as if it's all but
> certain that crypto-threatening quantum computers will exist in the
> next few years. I think no; reasonable people can certainly disagree.
> But let's try to avoid spitting contests. We will win by reaching
> consensus, not by saying the cleverest things.
>
> In that vein:
>
> "Blumenthal, Uri - 0553 - MITLL" <uri@ll.mit.edu> wrote:
> > >    This argument does not seem productive: essentially all cryptography
> > >    is based on hardness assumptions that have not been proved or
> disproved
> > >    (and, given our current knowledge, seem unlikely to be). If we
> accept
> > >    the above argument, the logical conclusion seems to be "disband
> CFRG".
> >
> > You equate "make new designs quantum-resistant" with "let's disband
> CFRG"??? Hmm...
>
> The argument was: "there is no way to prove or disprove convincingly
> this [security] concern", in the context of constructing crypto-threatening
> quantum computers, implies "make all new designs quantum-resistant."
>
> The point is, this doesn't go nearly far enough: "there is no way
> to prove or disprove convincingly this [security] concern", in the
> context of cryptography more broadly (and given prevailing beliefs
> vis-a-vis complexity theory), implies "give up".
>
> But we both agree that's absurd. So maybe we should rethink the premise
> here.
>
> Cheers,
>
> -=rsw
>
> _______________________________________________
> CFRG mailing list
> CFRG@irtf.org
> https://www.irtf.org/mailman/listinfo/cfrg

I'm agnostic to the threat of quantum computers. My stance is simply:
Design for the threat model you have, not the one you're worried about
having in 10 years. If you're worried about having to migrate to new
cryptography, ever, you should build versioning into whatever you're
building, so you can migrate when your threat model evolves. This is true
even if practical quantum computers somehow turn out to be impossible.

Thus, there's not much value in such speculation.