Re: [CFRG] NSA vs. hybrid

[Natanael <[e-mail]>]

Den tis 7 dec. 2021 02:21Mike Ounsworth <Mike.Ounsworth=
[e-mail]> skrev:

> I don't think the " PQ algorithms do not hold" case is as absolute as
> you're claiming:
>
>
> In cold storage encryption or any kind of public trust signature scenario
> (ie places where record-now-crack-later doesn't apply):
> 1) Implementation bugs in either traditional or PQC: hybrid makes these
> not-immediately-fatal and buys you time to patch and potentially re-protect
> existing data. (applies to both pre- and post-CRQC scenarios thanks to
> "quantum annoyance").
>
>
> In all scenarios:
> 2) Hybrid (esp. with 3+ algs) allows you to combine multiple PQC algs,
> spreading out your risk.
>

And my own main argument, rephrased in the list condensed form;

Most people worry about non quantum adversaries, some worry about both
quantum and non quantum adversaries.

PQ algorithms can break in that 1) they get reduced to classical quantum
weak security, in which case hybrid won't help but where they still resist
classical adversaries.

And 2) they can also break to even classical adversaries, in which case
hybrid does help because it's much less likely that the more well
established algorithms simultaneously break to classical adversaries.

As mentioned before #2 has already been observed. I anticipate to see it
happen again. Just because we failed to prevent a quantum attacker it
doesn't mean all is lost, because most relevant adversaries for most people
are still only classical adversaries. In addition hybrid under #2 raises
the cost of performing the attacks.

As for previous questions from earlier messages on the topic, we did not
use hybrid between RSA and ECC because ECC took so long to deploy that by
the time it was ready for use it was fairly widely trusted already. In
addition, it's fairly meaningless to deploy hybrid between algorithms with
fundamentally equivalent hardness assumptions and shared attacks. Hybrid is
most useful when the risks are different in between the algorithms of
choice.

>