Re: [Cfrg] Threshold signatures

[Phillip Hallam-Baker <[e-mail]>]

On Fri, Jan 3, 2020 at 10:24 AM Scott Fluhrer (sfluhrer) <[e-mail]>
wrote:

>
>
> *From:* Cfrg <[e-mail]> *On Behalf Of * Phillip Hallam-Baker
>


> We take a long time to get comfortable with it. NSA nagged us about
> Suite-B for how many decades before we started using ECC?
>
>
>
> At this point, I think we need to focus on making X25519/448 and
> Ed25519/448 the basis for the next gen of security products. It took about
> five years from AES being announced as a winner for it to become the new
> normal.
>
>
>
> Hmmmm, it is likely at some point someone will have a cryptographically
> relevant Quantum Computer, such a Quantum Computer can break elliptic
> curves (and, in fact, Elliptic Curves appear to be the easiest
> cryptographical object to break, as it requires the fewest qubits and
> circuit depth).  No one is certain when (or if) such a Quantum Computer
> will exist; maybe in 10 years, or 20.  However, if we are planning for the
> future, it would appear to be reasonable to take that into account, and
> include a postquantum scheme (possibly in conjunction with a classical ECC
> or RSA scheme)
>

Building a post-quantum PKI is a worthwhile project that the IRTF should
pursue and I would be very interested in participating in such a scheme.

But why should anyone believe we are capable of building a PKI with the
next generation of crypto technology that we haven't invented yet if we
still haven't deployed a PKI capable of meeting the needs of user
authentication across multiple devices, IoT onboarding or Data at Rest
security?

I am just as skilled in the art of procrastination as anyone else. The
reason I am focused on existing PKI technology is because that is what I
believe the world needs right now.

If we are serious about quantum, we should consider the worst case
scenario. That is someone has a working quantum machine capable of breaking
all existing public key systems in 2030 and we do not have a post quantum
algorithm we are confident in.

That is the only scenario I have currently considered for the Mesh and my
proposed approach is to use PKI while we still have it to establish shared
secrets and Lamport signatures that we can then use to establish a Kerberos
type key distribution scheme.

I do not think it is very likely the quantum folk will have such a machine
in 2030. But I am very confident that if they can build a machine capable
of breaking X25519 then it is game over for RSA4096. Don't be fooled by
Moore's law, the barrier to building bigger quantum machines is not minimum
feature size. Building a 1000 QBit machine today would be well within the
capabilities of the fabs. There would just be no way to use it before
losing coherence. The time to get worried is not when someone shows a 50 or
100 QBit machine, the time to get worried is when they can make it work
without the fridge. If they get trapped ions to work at scale, worry.
Biggly.

Right now, nobody is paying me to do any of this stuff. If people are
seriously worried about post quantum PKI, cut me a check and I will be more
than happy spending the next three, six months or however long it takes to
get something. But as things stand, the probability that we will see more
billion dollar data at rest breaches is 100% and the probability of a
quantum computer breaking x25519 by 2030 is less than 5%.