Re: [TLS] Before we PQC... Re: PQC key exchange sizes

[Phillip Hallam-Baker <[e-mail]>]

On Sat, Aug 6, 2022 at 11:29 AM Benjamin Kaduk <bkaduk=
[e-mail]> wrote:

> On Sat, Aug 06, 2022 at 04:00:59AM -0700, Rob Sayre wrote:
> > On Fri, Aug 5, 2022 at 10:15 PM Benjamin Kaduk <[e-mail]>
> wrote:
> >
> > >
> > > It's annoying to the attacker when they have to use their expensive and
> > > finicky
> > > hardware once (or multiple times) for each individual message/exchange
> they
> > > want to break,
> > >
> >
> > Well, I can agree with the term "expensive", but I'm not sure what you
> mean
> > by "finicky". Are you saying they only work sometimes? It seems a bit
> > hand-wavy to say that.
>
> (Note: my Ph.D. is in theoretical (quantum) chemistry.)
> Quantum mechanics is inherently a matter of probabilities and potential
> outcomes.
> Current hardware relies on either being very cold, very isolated from the
> surroundings,
> or both, to avoid unwanted coupling between qbits and the outside world
> that causes
> decoherence.  Achieving the physics in a physical engineering matter is
> inherently finicky,
> though you can build error-correction and robustness on top of it that
> helps.
>

That is not the only model of quantum computing. If it was, I would be
saying this entire effort is a silly waste of time because the approach is
fundamentally unscalable. They can throw lots of gates onto a chip but the
entanglement collapses before they can be used. So the capabilities inch
forward slowly and require ever greater amounts of cash.

The trapped ion machines operate at room temperature and can be made in
regular silicon foundries. Nobody has built a complete one yet but
prototypes do exist. If someone could get a complete ten qbit machine
working, they would scale to hundreds of thousands in the production
version. It would not be a gradual process, it would be like a Manhattan
project.

Fortunately we are a long way from that happening and the prototypes are
optical systems which are limited to a second or so. The hyperfine
transition machines have no such limitation.