[CFRG] CFRG and crypto-threatening quantum computers

["Riad S. Wahby" <[e-mail]>]

Hello Uri,

(Changed the subject line since we're pretty off-topic here.)

It seems silly for us to go back and forth point-by-point, especially
since most of our specific disagreements are minor and definitional.

    (e.g., What does CFRG do? Depends who you ask. From a research
    cryptographer's point of view the things we're documenting right
    now---pairing-friendly curves, hashing to curves, etc.---are
    roughly the same vintage as S/MIME!)

    (e.g., is USG making new quantum-susceptible standards? Well,
    should we count NIST's adding Ed25519 to FIPS-186?)

The high-level question is whether CFRG should act as if it's all but
certain that crypto-threatening quantum computers will exist in the
next few years. I think no; reasonable people can certainly disagree.
But let's try to avoid spitting contests. We will win by reaching
consensus, not by saying the cleverest things.

In that vein:

"Blumenthal, Uri - 0553 - MITLL" <[e-mail]> wrote:
> >    This argument does not seem productive: essentially all cryptography
> >    is based on hardness assumptions that have not been proved or disproved
> >    (and, given our current knowledge, seem unlikely to be). If we accept
> >    the above argument, the logical conclusion seems to be "disband CFRG".
> 
> You equate "make new designs quantum-resistant" with "let's disband CFRG"??? Hmm...

The argument was: "there is no way to prove or disprove convincingly
this [security] concern", in the context of constructing crypto-threatening
quantum computers, implies "make all new designs quantum-resistant."

The point is, this doesn't go nearly far enough: "there is no way
to prove or disprove convincingly this [security] concern", in the
context of cryptography more broadly (and given prevailing beliefs
vis-a-vis complexity theory), implies "give up".

But we both agree that's absurd. So maybe we should rethink the premise
here.

Cheers,

-=rsw