Re: [TLS] Confirming Consensus on removing RSA key Transport from TLS 1.3

[Andy Lutomirski <[e-mail]>]

On 03/27/2014 06:01 AM, Hanno Böck wrote:
> On Thu, 27 Mar 2014 12:27:17 +0000
> It will be easier to build a quantum computer to break 512 bit keys
> than one to break 4096 bit keys. That's why in a word where quantum
> computers become a reality I'd rather go with RSA+DHE with large
> key/modulus than with anything from the ECC family.

Barely.

With my quantum cryptography hat on, I think this is a pointless thing
to design in.  If you can build a big enough quantum computer to run any
of the period-finding / hidden subgroup algorithms, then it seems
extremely likely that you have a real fault-tolerant machine with a real
memory interconnect.  At that point, the machine size scales pretty much
linearly with the size of the group.

It's a bit different if the attacker has an adiabatic machine, but I'd
be absolutely shocked if the first machine to run Shor's algorithm is
adiabatic.

--Andy