Re: [CFRG] CFRG and crypto-threatening quantum computers

[John Mattsson <[e-mail]>]

Hi,

I think US government (NSA) has a quite good stance on this for protection of US NSS systems expressed in their recent FAQ:

"NSA does not know when or even if a quantum computer of sufficient size and power to exploit public key cryptography (a CRQC) will exist."

Yet they plan to begin transition very soon:

"Our preferred parameter set is Section 4.2, LMS with SHA-256/192"

"The intention is to update CNSA to remove quantum-vulnerable algorithms and replace them with a subset of the quantum-resistant algorithms selected by NIST at the end of the third round of the NIST post-quantum effort."

End of the third round will be close to the end on 2021 if I remember correctly.

https://media.defense.gov/2021/Aug/04/2002821837/-1/-1/1/Quantum_FAQs_20210804.PDF

Note that NSS is very high-security where TOP SECRET information needs protection for decades. Many other systems should take a slower wait-and-see approach where PQC is phased in when the quantum threat is more emminent. All information does not need to be secure for decades. Current PQC algorithms have limitations and the sizes would be problematic in many IoT systems.

I think Quantum is an area where CFRG also need to filter out things from academia. You can find statements from academia that quantum cryptography will magically secure the Internet and that that quantum computers will soon practically break AES-128 ...

I think CFRGs current approach is great. CFRG specified LMS and XMSS for systems that want to consider risks decades into the future. CRFG also works on ECC and RSA for systems that do not want to consider risks decades into the future, or for for the possible outcome that Cryptographically Relevant Quantum Computer (CRQC) will never be built.

Cheers,
John