Re: [Cfrg] Fwd: I-D Action: draft-yonezawa-pairing-friendly-curves-01.txt

On Wed, Apr 3, 2019 at 7:54 AM Blumenthal, Uri - 0553 - MITLL
<uri@ll.mit.edu> wrote:
>
> In short, the problem is that one group of people accepts the risks for another group of people.
>
> As one of back officials said in a private discussion: "Your risk is always lower than our cost."

If you don't like these protocols, don't use them. I really do not
understand the issue here: pairings provide all sorts of efficiencies
and nice protocols that we cannot get other ways. The argument that
now we need to stop doing some kinds of cryptography because in some
as of yet unknown timeframe quantum computers will break all the
schemes (ignoring the difference between authentication and
encryption) made as much sense in 1996 as it does today. And yet today
it is problem but was not in 1996?  TLS 1.3 does not have any
post-quantum ciphersuites. The answer here is a good security
considerations section.

>
> Regards,
> Uri
>
> Sent from my iPhone
>
> > On Apr 3, 2019, at 10:48, Watson Ladd <watsonbladd@gmail.com> wrote:
> >
> >> On Wed, Apr 3, 2019 at 4:29 AM William Whyte <wwhyte@onboardsecurity.com> wrote:
> >>
> >> Hi Peter,
> >>
> >>>> Another thing about PQC is that all of this is entirely new crypto that we
> >> have no experience in using.  We've had decades of experience with using
> >> PreQC, and have mostly managed to get it right (a lot of the attacks being
> >> performed were known about years ago but were ignored until someone published
> >> an attack paper with accompanying tools and newsworthy name, and even then
> >> there's a huge amount of code in PreQC crypto designed specifically to prevent
> >> entire classes of attacks), while we have zero experience with using PQC.
> >>
> >> This is an argument for being cautious about deploying PQC. It's not an argument
> >> that it's a good idea to develop new PreQC primitives. If anything, it's an argument
> >> against that.
> >
> > There are protocols that only work with new primitives. Some people
> > are willing to accept the risk.
> > What's the problem?
> >
> >>
> >> Cheers,
> >>
> >> William
> >>
> >>
> >>> On Tue, Apr 2, 2019 at 7:57 PM Peter Gutmann <pgut001@cs.auckland.ac.nz> wrote:
> >>>
> >>> Björn Haase <bjoern.m.haase@web.de> writes:
> >>>
> >>>> We know that the cost of conventional attacks is low and many applications
> >>>> are actually "worth" the effort of an attack.
> >>>
> >>> Another thing about PQC is that all of this is entirely new crypto that we
> >>> have no experience in using.  We've had decades of experience with using
> >>> PreQC, and have mostly managed to get it right (a lot of the attacks being
> >>> performed were known about years ago but were ignored until someone published
> >>> an attack paper with accompanying tools and newsworthy name, and even then
> >>> there's a huge amount of code in PreQC crypto designed specifically to prevent
> >>> entire classes of attacks), while we have zero experience with using PQC.
> >>> Which means we're going to see years if not decades of new attacks, or the
> >>> same old attacks that were fixed in PreQC implementations, popping up with
> >>> PQC.  It's quite possible that PQC will make us a lot *less* secure, if QC
> >>> never really happens but the expected vulnerabilities in using PQC do.
> >>>
> >>> In fact I'll make this prediction now:
> >>>
> >>>  Likelihood of successful attacks due to QC: Epsilon.
> >>>  Likelihood of successful attacks due to use of PQC over PreQC: 100.0%.
> >>>
> >>> (the second figure should actually be much higher than 100%, because there'll
> >>> be many, many of them, not just one).
> >>>
> >>> Peter.
> >>>
> >>> _______________________________________________
> >>> Cfrg mailing list
> >>> Cfrg@irtf.org
> >>> https://www.irtf.org/mailman/listinfo/cfrg
> >>
> >>
> >>
> >> --
> >>
> >> ---
> >>
> >> I may have sent this email out of office hours. I never expect a response outside yours.
> >> _______________________________________________
> >> Cfrg mailing list
> >> Cfrg@irtf.org
> >> https://www.irtf.org/mailman/listinfo/cfrg
> >
> >
> >
> > --
> > "Man is born free, but everywhere he is in chains".
> > --Rousseau.
> >
> > _______________________________________________
> > Cfrg mailing list
> > Cfrg@irtf.org
> > https://www.irtf.org/mailman/listinfo/cfrg

-- 
"Man is born free, but everywhere he is in chains".
--Rousseau.