Hacker News Reader

Comment by dsp | Hacker News Reader

Obligatory djb warnings: https://ntruprime.cr.yp.to/warnings.html

Here's the warning: Lattice-based cryptography is much more risky than commonly acknowledged. This applies, in particular, to lattice KEMs under consideration within the NIST Post-Quantum Cryptography Standardization Project (NISTPQC) as of October 2021. The above document...

There's a linked PDF paper with more detail.

What does "djb" mean here?

https://en.wikipedia.org/wiki/Daniel_J._Bernstein

Is djb involved in any of the standardized algorithms here by the way?

Yes, many. I believe he's on the SPHINCS+ team (was standardized), Classic McCliece (round 3, not standardized), and NTRU_PRIME (round 3, passed over for Kyber). Perhaps more, but he has significant skin in the game.

Isn't that the point of having "hybrid" mode?

HMAC(pqc_shared_secret, ecc_shared_secret)

What's the "obligatory djb warnings"? Something like "any crypto that's not mine isn't great"? ;)

from skimming it, his main argument is that Kyber relies on many constructions (e.g. cyclotomic polynomials) that are actively under attack - researchers have been successfully chipping away at them and show no signs of stopping.

he also alleges that NIST have been moving the goal posts to favor Kyber, and they've been duplicitous in their narrative.

he favors NTRU, which iirc isn't his.

Cyclotomic polynomials are incredibly standard in the field. The only researcher I know of who has issues with them is DJB, and there has not been significant advances in cryptanalysis due to usage of cyclotomics (with the exception of problems not used by NIST candidates, meaning the whole SOLIQUAY thing)

My understanding is that he worked on NTRU Prime, which would have somehow benefited from NTRU being choosen.

NTRU also relies on cyclotomic rings, so if distrust in cyclotomics was a good reason to reject Kyber, it would apply to NTRU too.

should really be higher up.

Reply on news.ycombinator.com