SHA3-256 is quantum-proof, should last BEELLIONS of years
theregister.co.uk
theregister.co.uk
First of all it's no secret that quantum attacks aren't a big problem for hash functions, there's "only" a need to switch to longer outputs. The major impact of quantum computers will be shor's algorithm, which affects public key algorithms.
But it seems the author of this article also didn't really understand the paper linked. It only looks at preimage attacks. We generally expect hash functions to be resistant to collision attacks, which is a much stronger statement.
And here things aren't that rosy. 256 bit algs have by design only 128 bit of collision resistance. Grover's alg reduces that to 64 bit, which is not comfortably secure. Granted, one would need a pretty big cluster of quantum computers to practically break that, but if you go postquantum you should probably better go to 512 bit algs.
However none of that changes with this new paper.
But first we have to see how many qubits can technically be kept functioning. Anybody knows the current record? Is it better than March 2016:
http://www.scottaaronson.com/blog/?p=2673
"Briefly, the new work uses Kitaev’s version of Shor’s factoring algorithm, running on an ion-trap quantum computer with five calcium ions, to prove that, with at least 90% confidence, 15 equals 3×5."
"In any case, regardless of how long it takes until we can factor enormous numbers like 91, congratulations to the MIT and Innsbruck groups on what’s certainly progress toward scalable ion-trap QC!"
It's not 91 bits, it's 91 as the number, that is, 7 bits as a goal, 4 bits (for the number 15) in the successful demonstration.
Which secure 512 or 1024 bit symmetric encryption algorithm should I use to be 'quantum proof'?
This is a bit different for block ciphers and hashes.
The very brief / simplified explanation: Block ciphers have a security level of their key size, so aes256 has a prequantum security level of 256 bit, which means a postquantum security level of 128 bit. Hashes however have - due to the requirement for collision security and the birthday paradox - a security level half of their size. Therefore for 128 bit prequantum security you need a 256 bit hash and for 128 bit postquantum security you need a 512 bit hash.
And combining the lower-bit algorithms into the bigger ones is relatively easy, as an example from the 56-bit DES a 3DES with security of around 112 bits was made and (is still) used:
https://en.wikipedia.org/wiki/Triple_DES
edit: re: the early collisions with 64-bits etc: If I understand, the problem happens only when the soon-enough rekeying doesn't:
I agree it's better to avoid these altogether.
I don't think so -- that doesn't cover public key cryptography. I'm pretty sure that one-way function and a symmetric cipher (which is basically just a secure RNG) are enough to produce a public key cryptosystem, which requires a trapdoor one-way function.
In practice classical rho collision-finding is more resource-efficient: replace the crazy ~2^85 storage by ~2^85 small memoryless computing units, and find a collision in 2^128 / 2^85 ~ 2^43 time. Or match the quantum time with only ~2^43 computing units, and negligible storage.
"The paper notes: “The main difficulty is that the coherence time of physical qubits is finite. Noise in the physical system will eventually corrupt the state of any long computation.”"
However, just yesterday, I read that new research had once again lengthened the qubit coherence time, this time by a factor of ten. A little quick googling reveals that this time is growing. Rapidly.
"While our cost model ties us to a particular quantum architecture, we segment our analysis into several layers so that the impact of a different assumptions at any particular level can be readily evaluated."
"Our estimates are by no means a lower bound, as they are based on a series of assumptions. First, we optimized our T-count by optimizing each component of the SHA oracle individually, which of course is not optimal. Dedicated optimization schemes may achieve better results. Second, we considered a surface code fault-tolerant implementation, as such a scheme looks the most promising at present. However it may be the case that other quantum error correcting schemes perform better. Finally, we considered an optimistic per-gate error rate of about 10^5, which is the limit of current quantum hardware. This number will probably be improved in the future. Improving any of the issues listed above will certainly result in a better estimate and a lower number of operations, however the decrease in the number of bits of security will likely be limited."
Which remains huge for these hashes. In short:
"Diffie-Hellman key exchange, RSA encryption, and RSA signatures will all need to be replaced before quantum computers are available. The situation is less dire for hash functions and symmetric ciphers."