Re: [CFRG] NSA vs. hybrid

["Blumenthal, Uri - 0553 - MITLL" <[e-mail]>]

CRQC (Crypto-Relevant Quantum Computer) is a threat in two ways:
1. Breaking your key exchange and decrypting your confidential information;
2. Forging your digital signature and/or authentication.

For sensitive data, problem (1) is relevant now - because, as you said, ciphertexts could be recorded now and broken/decrypted decade(s) later, when CRQC is available. Hybrid won't help here (and those who don't expect CRQC to arrive, can stay with ECC).

As to (2), it's unclear when we need to start worrying (though, probably, not now). Clearly, it's of no advantage to the adversary to forge my signature now on a TLS session established 10 years ago. It may well be a concern for legal documents - e.g., if somebody 10 years from now forges a signature on a mortgage - but I can't evaluate this risk, as I don't have enough understanding of the field. 

So, "quantum annoyance" is not an answer for me: for short-lived data, I don't care at all (for now) - and for long-lived (presumably important) data I can't rely on "well, they're busy cracking zillions of somebody else's data, and my data's turn may not even come".
--
Regards,
Uri
 
There are two ways to design a system. One is to make it so simple there are obviously no deficiencies.
The other is to make it so complex there are no obvious deficiencies.
                                                                                                                                     -  C. A. R. Hoare