Hacker News Reader

Comment by upofadown | Hacker News Reader

Isn't all this post quantum stuff a little premature? The standards haven't settled. We don't even know if there is a possible quantum threat to cryptography yet. The more we work on the problem the less likely it seems. Last I heard we were 1 or 2 orders of magnitude away from physical noise performance that would make such a threat possible.

Edit, added: Harvest now, decrypt later applies to any encrypted data. There is nothing special about the quantum threat. This all only makes sense if we can predict what the actual threat is ... and so far we can't. This reminds me of Pascal's Wager[1]

[1] https://en.wikipedia.org/wiki/Pascal%27s_wager

View on HN

You'd be right except that anything encrypted now can be stored and cracked later.

I remember as part of the snowden leaks there was documentation about this kind of delayed phase collection.

Basically store as much signals data as you can and try to crack it later if there's a weakness discovered with the protocol or computing power starts being capable of wholesale attack.

You might remember that hashes are significantly easier to crack with "rainbow tables", and so we added cryptographic "salts" to online password storage. We discovered that about 15 years ago and started salting all our passwords, but for a large window of time all of those old leaked databases were suddenly extremely easy to crack.

Now, Imagine the NSA is 10 years ahead of us (and you might be close with that estimation), so even if they can't crack RSA right now they're much closer than we are, and even we get there we will likely have a large window of time before we fix it properly. (not that we're talking RSA here, but you get my point).

https://www.forbes.com/sites/andygreenberg/2013/06/20/leaked...

RSA isn't anywhere near 10 years away from being attackable with a classical computer. (More like eons.)

It's not a matter of time, it's just a matter of quantum computers existing.

That Forbes article is about a loophole involving encryption that could allow the NSA to collect and store data that they might not otherwise be able to. Now that everything is encrypted, that loophole might cover everything.

Nothing in the article implies that the NSA can magically collect all the encrypted data in the world and keep it for many years.

Like the article says, it's protection from harvest-now-break-later.

Apple users and communications are today a state-secret affair as shown by the impact of NSO/Pegasus.

So even if Google,IBM,et al _might_ have approached feasibility in the open there is still a significant risk in state-level adversaries having poured enough funding to still be ahead, plus they will benefit from all open research in the hidden with extra funding to take more leaps.

So no, it's not premature if there is hidden or open leaps just 10 years in the future.

We have reason to believe that conventionally encrypted data isn't threatened within the next 50 years by anything other than quantum computing, which is what's special about the quantum threat.

From the article:

>> Although quantum computers with this capability don’t exist yet, extremely well-resourced attackers can already prepare for their possible arrival by taking advantage of the steep decrease in modern data storage costs. The premise is simple: such attackers can collect large amounts of today’s encrypted data and file it all away for future reference. Even though they can’t decrypt any of this data today, they can retain it until they acquire a quantum computer that can decrypt it in the future, an attack scenario known as Harvest Now, Decrypt Later.

> Edit, added: Harvest now, decrypt later applies to any encrypted data. There is nothing special about the quantum threat. This all only makes sense if we can predict what the actual threat is ... and so far we can't.

But we know Shor's algorithm, and we've started building prototype quantum computers. Isn't that enough to build something that counters them? Worst case, we deploy new ciphers and realize that the threat was empty 50 years from now. What's the downside?

One reason to move sooner rather than later is to mitigate the threat of previously stored data. There may be a government entity simply storing all imessage traffic in the hopes of one day decrypting it when/if a breakthrough happens. If you transition sooner, you increase the age of the latest data that could be decrypted, thusly hopefully making it safer.

this is capitalism. why would they care unless the decryption happens this fiscal quarter?

> Last I heard we were 1 or 2 orders of magnitude away from physical noise performance that would make such a threat possible.

The entities with the most to gain from such an advancement are not exactly known for publicizing their achievements.

Reply on news.ycombinator.com