Re: [Cfrg] Fwd: I-D Action: draft-yonezawa-pairing-friendly-curves-01.txt

[Peter Gutmann <[e-mail]>]

Blumenthal, Uri - 0553 - MITLL <[e-mail]> writes:

>Do you think then, that quantum computers capable of threatening, e.g., ECC,
>won't come in the next 50 years or so, if at all?

>From the existing data we've got, yes.

  Someone may or may not build a cryptanalysis-capable quantum computer,
  someone may or may not prove/disprove one of the many mathematical
  assumptions underlying our cryptosystems, space aliens may land and tell us
  that what we're using is the sort of crypto that newly-hatched space spawn
  solve as basic homework exercises, or any other kind of fantastic event may
  or may not occur, but what will definitely happen is that attackers will use
  trojan-horse software to steal keys, take advantage of software bugs, employ
  side-channel attacks, backdoor the crypto, and perform a million other
  actual attacks that are being used right now.

  It doesn't matter whether you can build a magic quantum computer or not when
  another process in the system can suck your crypto keys right out of memory.
  It's not magical attacks from the future that you need to worry about, it's
  real attacks from right now.

Having said that, it doesn't mean cryptographers won't invest vast amounts of
time and effort into PQC.  It's a cool chance to reset the crypto world and
start again with entirely new designs, which is always fun to do.  There's
entire conference tracks just waiting to be held on all this, new journals,
research funding, government contracts, the sky's the limit.

Peter.