Re: [Cfrg] A terminology issue with "post-quantum cryptography"

The assertion highlighted in yellow is interesting. The IEEE is publishing papers concerning the factoring topic and the utility  was demonstrated at a ATC IEEE Trusted Computing workshop in Silicon Valley August 4. It has been around a while. It is being demonstrated at the Hague during another conference particularly to NATO and Europol in October.

Before knee jerk comments it is recommended that you build and test it. Scientific method and informed comments are always good. It is simple enough to build. It is also simple to request a copy of the utility if you can be permitted under regulatory regime.

AB

http://www.wnlabs.com/news/ECC-is-easier-to-break.php

http://www.wnlabs.com/pdf/IEEE-ATC-R-CyberTrust-27.pdf This informs engineers or beginner computer scientists how to build utility.

http://www.wnlabs.com/news/IEEE_copyright_WN_papers.php

-----Original Message-----
From: Cfrg [mailto:cfrg-bounces@irtf.org] On Behalf Of Dan Brown
Sent: Friday, August 18, 2017 9:03 AM
To: D. J. Bernstein; cfrg@irtf.org
Subject: Re: [Cfrg] A terminology issue with "post-quantum cryptography"

How about quantum-prudent or quantum-cautious cryptography?

/*

I'm not a PQC researcher, so please feel free to ignore my $0.02.

Finding (brief) terminology for this topic seems difficult, mainly because of the extra conjectures and timing (see below).  But it is only terminology, so it is probably okay just to stick to a tradition, or okay to churn it up, or be imperfect.

There is a need (see below) for distinct terminology for task and the tool.  For example, McEliece (the tool) is (reasonably) conjectured to provide quantum-resistance (the task).  Postquantum crypto could a help as a noun for a generic tool (conjectured to be quantum-resistant).

There seems some value in specificity.  For example, ECC is rarely called post-factoring or sieving-resistant ,etc. (to address the non-zero risk of a faster classical-computer factoring or sieving algorithm), partly because that's not specific to ECC.

There is a need for quantum-resistance because of a non-negligible risk of quantum computer. But it is bad if pushes towards this need seem to imply dropping ECC, because that would trade one risk for another.  Terms like postquantum and quantum-resistant do little to remind us that a quantum computer is only conjectural (questionable), so these terms must often be accompanied by further clarifications and explanations (e.g., don't drop ECC).

Supplementing ECC or RSA with some kind of conjecturally quantum-resistant proposal pre-emptively is often justified (the cost is worth addressing the risk), but calling this "postquantum" does not go far enough to encourage this practice (because post suggests waiting) or clarify the timing (recall how NIST called forward secrecy backtracking resistance.)

Shor's algorithm makes it a certainty that a large-enough quantum computer would break RSA and ECC. Confusing that certainty with various PQC proposals being quantum-resistant is inaccurate.  In this regard, the leading terms postquantum and quantum-resistant overstate the case (as do quantum-prudent and quantum-cautious).  To this end, I tried to think up a short name more specific to Shor's algorithm, but only came up with silly jokes, such as shor-ward-secure, or vague techno terms like no-hidden-group.  (This strategy also completely ignores the symmetric key case and Grover's algorithm, but that situation is simpler.) */

_______________________________________________

Cfrg mailing list

Cfrg@irtf.org<mailto:Cfrg@irtf.org>

https://www.irtf.org/mailman/listinfo/cfrg