Hacker News Reader

Hacker News

Comment by cm3 | Hacker News Reader

Parent Full thread

cm3

But there is splitting involved, or it's duplicate, isn't it?

Edit: What's the name of the scheme used?

View on HN

Their blog post goes into more details: https://security.googleblog.com/2016/07/experimenting-with-p...

They are using "New Hope" on top of EC-crypto and calling it CECPQ1-ECDSA.

I've read that, but can't find the details or make concrete sense of the scheme involved.

    will use a post-quantum key-exchange algorithm in addition to the
    elliptic-curve key-exchange algorithm that would typically be
    used. By adding a post-quantum algorithm on top of the existing
    one, we are able to experiment without affecting user security.
    The post-quantum algorithm might turn out to be breakable even
    with today's computers, in which case the elliptic-curve
    algorithm will still provide the best security that today’s
    technology can offer.

I mean, I can't answer the question with the info found in the blog.

Hanno commented this is a well known scheme without mentioning the name. If someone knows the name, I'll look that up. In the meantime, I'll dig through the code to understand what they're actually doing.

The new key exchange is based on lattice cryptography, which is conjectured to be quantum resistant. The precise assumption is RLWE.

Thanks, and yes, I've read about what hardness assumption is used.

My confusion is about what pieces are concatenated. Is the same input processed twice (different ciphers) and then concatenated, which is then the generated key?

The outputs of an RLWE and ECDH handshake are both fed into the TLS KDF.

Thanks for the info. May I ask if you figured that out from the blog or BoringSSL code?

The hybrid ciphersuite idea comes from [1, Section 5.2], though you could also chalk it up to common sense. I don't think the blog spells out how it's done.

[1] https://eprint.iacr.org/2014/599

Adam Langley answered this on HN: https://news.ycombinator.com/item?id=12051438

Since we're talking about key exchange, shouldn't it be called CECPQ1-ECDHE? ECDSA is for the cert...

Reply on news.ycombinator.com