Why Quantum Cryptanalysis is Bollocks [pdf]
cs.auckland.ac.nz
cs.auckland.ac.nz
A lot of this presentation is mooted by understanding PQC as an scientific question rather than an engineering one. What are the precise natures of quantum-superior attacks on cryptosystems and what are key establishments and signatures that resist those attacks? Whatever else you think of quantum cryptanalysis those are undeniably important theoretical questions.
A few more slides are mooted by the likelihood that any mainstream deployed PQC system is going to be hybridized with a classical cryptosystem.
As an articulation of a threat model for modern computing, it simultaneously makes some sense and proves too much: if you think OWASP-type vulnerabilities are where everyone's head should be at (and I sort of agree), then all of cryptography is a sideshow. I'm a connoisseur of cryptographic vulnerabilities that break real systems the way SQL injection does (a bitflipping attack on an encrypted cookie, a broken load-bearing signature scheme) but even I have to admit there's 1 of those for every 10,000 conventional non-cryptographic attack.
But of course, it also depends on who your adversary is. Ironically, if you're worried about state-level SIGINT, the barrier for OWASP-style attacks may be higher than that of large-scale codebreaking; passive interception and store-now-decrypt-later is the SIGINT love language.
My biggest thing with all of this is a core belief about organizations like NSA: that they exist primarily to secure budget for NSA. Given that, the one thing you absolutely don't want to do is have a system that is breakable only at almost-implausible cost.
(Also, his RSA-1024 analysis is off; it's missing batch attacks).
... you might be worried about other things like postal interception, or physical security of your devices. You can never order any electronics or anything online, or use couriers services if you are person of interest for state level spooks like FBI, CIA. Tech spooks making personal visits to your home, phone or computers in-person also possible.
For many foreign states like US and China its's easier to them to intercept and alter packages going trough borders. Both legally and logistically.
It has already been documented how CIA and FBI have permanent presence in main courier airport hubs. It's easy for Amazon, FedEx or USPS to divert packet or letter trough convener belt that goes trough government areas.
Same for Chinese of course. Anything ordered from China with your name or address cant' be trusted if you believe you might be sufficiently important person of interest for them.
I’m tempted to draw an analogy to the space race of the 60s, and the current AI panic
Right after I launch my new cryptocurrency QuantumDog.
The decision to move the world to PQC has already been taken, and we are in full transition mode. Orgs like NATO has transitioned. Many have published time plans to phase out classical algos (NSA, GHQC, Australia) or will shortly (EU). Orgs like ETSI will transition to PQC in upcoming revisions (5G) and next gen systems (6G). Just to name a few.
In general, looking at agencies, nations pushing for PQC algorithms and transition time plans seems to be curiously well aligned. All using the NIST PQC algos, no real mentioning of hybrid solutions. Australias plan to ban the use of SHA-256 is one that sticks out a bit from the others.
Regarding time plans, I find the suddenness, almost haste to be quite interesting. I've been searching quite extensively to gather info for PQC talks, and the motivation for a stated time plan are rarely well motivated. Much hand waving. And what drove the rush? I'm suspecting a bit of a crowd panic. But there is a clear change around 2022, 2023. Suddenly the PQ threat became very important. And within 10 years (or less) the world will be using PQC basically everywhere PKI is used besides legacy systems where lifetimes and update issues makes the change unrealistic.
And are we really sure the schemes used will be hybrid? If DJB is right, NIST is pushing for PQC only. The NSA recommendations that was released last year AFAIK does not state anything about hybrid solutions. Details are less clear what NATO has transitioned to but seems to be PQC only. And the ETSI push for PQC in 5G, 6G does not seem to aim for hybrid solutions. I would love to be told to be wrong about the use of hybrid schemes.
The iMessage protocol, Signal and things happening in IETF goes for hybrid schemes, which I think is the right way (if that count for anything). So it seems we have the open world and private sector versus governments, orgs fairly close to governments when it comes to hybrid vs PQC only.
I think that's probably because the NIST competition [1] to choose their standard algorithms really started to heat up then.
NIST has a very large gravity well in the academic and industrial cryptographic community, so as soon as it became clear which algorithms NIST would pick (they chose Kyber / ML-KEM and Dilithium / ML-DSA), the (cryptographic) world felt it could start transitioning with much more certainty and haste.
1. https://csrc.nist.gov/projects/post-quantum-cryptography/pos...
A bit off topic, as a European, what is happening with DOGE, slashing funding for CISA, TAA etc, I'm seriously worried about NIST. As you say, NIST is very important in many areas. For USA, with things like the coordintated universal time normal. But also for federal cybersec standards that have led to interop with the rest of the world cryptographically. Will NIST be slashed, and if so will the crypto department be spared? If not, what would remain? New standards, the validation program? Will Falcon become a standard, or for that matter the new lightweight symmetric algo based on Ascon? (For which I'm eagerly waiting for NIST to publish test vectors so that I'm able verify that my implementation is compliant.)
The reverse picture, where they do and we haven't, is so colossally damaging that it doesn't matter if the probability of quantum breaks landing is actually quite small. In expected value terms we still come out ahead.
You don't need to assume that someone in an NSA lab has already demonstrated it for this to work out, and you don't need to assume that there is ever a practical quantum computer deployed for this stuff. All you need is for the probability to be above some small threshold (1%? 5%? I could believe something in that range) to make running for the exits the right move today.
Because the current plans aren't to migrate to just hybrid classical+PQC schemes, the plans are to migrate to PQC fully. Discarding both RSA and ECC.
This isn't true. NIST has been saying that, but everyone else just laughs and implements hybrid since throwing out RSA/ECC is so obviously stupid.
The Australian government is also saying this.
My view is that IETF and commercial entities such as Apple, Google and open source world are the ones going hybrid. In this case I would love to be wrong.
The world has decided that the percieved risk makes it worth going to PQC and we can't change that fact no matter the nice pictures of Schwerer Gustav. We are in full transition mode and will not go back. Even if CRQC never materialize.
We probably will experience a number of issues, problems that we wouldn't have by not going to PQC. Driving costs, making things vulnerable. More work for us I guess.
- Dilithium + Kyber is faster than ECDSA + ECDH on the same hardware. Depending on the platform, it can be up to 33% faster.
- Most commercial entities are implementing hybrid, but in concatenation, not layered, mode. The classical inclusion is mainly for compatibility with "legacy" systems.
The negative thing for all systems with the current NIST PQC algoritms are the longer keys, which gets even worse when going hybrid. See the experiments by Cloudflare for example with PQC in TLS, and adding PQC keys in certificates.
I agree that for certificates, there is a possibility of being compatible with legacy systems by adding the ML-DSA signature as an extension (and the legacy system being able to handle the larger certs). But please show references for the main reason for hybrid is compatibility. IF we look at the motivation for the TLS 1.3 hybrid scheme it states:
"The primary goal of a hybrid key exchange mechanism is to facilitate the establishment of a shared secret which remains secure as long as as one of the component key exchange mechanisms remains unbroken."
(https://www.ietf.org/archive/id/draft-ietf-tls-hybrid-design...)
That page states that backwards compatibility maybe is one of several possible additional goals. But it is not the main goal.
The problem PQC algorithms must solve is not only to be resistant to attacks by future quantum computers but also against attacks on classical computers. And the hardness in terms of security as the number of bits in the key must scale about as fast as classical algorithms. And work as about well a classical algorithms on classical computers.
All ciphers have warts. The ones we use are the ones we think are secure, but also have warts we can live with. RSA scales slowly with number of bits (and have other warts). EC scales faster and becomes faster than RSA for the same strength, but has other warts. McEliece seems like a good, conservative PQC algorithm, but those keys... TDEA was deemed to provide a too low security margin, but it also was to slow (48 rounds) and with a too small block size.
I hear you saying this: Gutmann's factual points may be correct. But he is discussing quantum computing. Quantum computing is so irrelevant to post-quantum cryptography that even mentioning it in that context makes Gutmann seem disconnected from reality.
I don't necessarily disagree. I'm just trying to make sure I understand.
1. I read the first part, with Gustav Schwerer etc as an argument against CRQC to ever become possible, so moving to PQC is not needed.
2. I read the second part, about the hardness of attacking classical algorithms, for example the DES cracker as a motivation against attacks on crypto being an actual threat vector. Which ties in to point 1 as a CRQC would be very expensive and hard to use in practice. It is not a computer but a physics experiment.
3. He then talks about real threats and how they don't change very much. Points to OWASP top ten etc.
I totally agree with him on point 1 and 2. I'm just as skeptical. But what I'm saying is that it is too late. We are quite possibly switching to algorithms that will never add any security. Spending huge resources and pushing unneeded changes to systems around the world. Telling the world that it is unnecessary will not change that fact.
Coming to point 3. I don't agree with him. Yes, OWASP top 10 shows the same more or less trivial attack are the ones being used. Nobody use a zero day unless it is needed. If I can become sysadmin through a reused password or a misconfiguration of Teams, why use something more advanced? But I see him using this as an argument against ciphers being broken a real threat vector, and that is a different attack.
The first one is an active attack against a system. It may be a nation state actor that wants to infiltrate, get a persistent access, exfiltrate and possibly destroy the system. It may be a ransomware organization. They will do the same thing, but their timeline is much shorter. (and of course the difference between a nation state and organized crime can be very blurry).
But recording Internet traffic, and over long time (days, months, years, decades) try to decrypt it are solely of interest to a nation state. And for that attack and end game, what OWASP top ten looks like is totally irrelevant. It is not an active attack against a system. It is done in secrecy by entities with a lot of patience by entities that have huge resources. For them Quantum Computers are very interesting and relevant to discuss. But not in public.
I guess that was a waay to long answer. But I hope it explained what I ment.
there are so many roads to rome, intelligence communities i gather have taken also to more open roads than breaking any type of crypto. (not to say they dont do that anymore) If its more operationally useful, so they will be doing it. That's a given.
Indeed he don't hold back and is quite funny in his frankness.
Though when it comes to his book draft, he really need an editor. https://www.cs.auckland.ac.nz/~pgut001/pubs/book.pdf
If you want to see the progress in quantum computing today, pay attention to component reliability. For example, in 2014, the best rep code run on a quantum computer had a 1% error rate per round [1]. In 2024, it was 0.00000001% and it had become possible to run full quantum codes with a 0.2% error rate per round [2]. If it takes another decade for that 0.2% to go down by a factor of a thousand, then you've got lots of time. Maybe you'll be dead before progress exceeds the coarseness of factoring. If it takes a year instead of decade (because the cost of error correction is frontloaded) then, well, pay appropriate attention to that.
Last I heard we were 1-2 orders of magnitude away from a physical qubit error rate low enough for error correction to have a chance of creating a threat against cryptography. So things sound pretty unlikely at the moment. We need a fundamental breakthrough.
This is a lot like the Y2K problem, in that nothing particularly bad happened because a lot of people spent a lot of time and money on fixing things. That doesn't mean we shouldn't take them seriously.
Fancy crypto attack: You have a 0.00001% change of recovering 2 bits of plaintext from a single message
Any of the OWASP top ten: You have a 100% chance of recovering the plaintext of all the messages
One of my favourite recent examples (2020): "LadderLeak: Breaking ECDSA With Less Than One Bit Of Nonce Leakage" https://eprint.iacr.org/2020/615.pdf
As for the partial nonce, I've seen many attacks on this kind of issue, but I've yet to see this mistake made.
It's like saying that when driving on a road, the "wheels fall off" risk is overhyped. Wheels falling off may be low on your personal list of concerns, but only because car manufacturers make sure they don't design cars whose wheels fall off. A car with wheels that fall off would be unacceptable.
Here's an in-the-wild example of weak nonces being used to compromise Bitcoin wallets: https://research.kudelskisecurity.com/2023/03/06/polynonce-a...
That is one theory and plausible, but another plausible theory is the conditions to setup a timing attack is usually infeasible due to requiring high precision timing, a very large number of samples/measurement, and requiring probes in an ideal situation. AES in software is still a good example of an algorithm where timing attacks are still possible. Take for example djb paper on cache timing [1], it requires 4 million samples before key recovery. The reality is that kind of attack is highly unlikely to occur, and there's been opportunities where non timing safe AES has been used. I'd argue the more pragmatic stance of an attacker is that that timing attacks aren't really practical unless attacking a protection mechanism of a piece of hardware like the Xbox 360, at least for network services it is really low on the list.
As for the ECDSA attack, again impressive feat, but only 773 wallets which isn't real cause for concern. I think the bigger concern is using amateur 3rd party implementations of bitcoin that doesn't do nonce generation properly when signing, it really isn't that hard, but I agree it can be a footgun. The reality is this is still a negligible concern compared to real attacks happening everyday draining crypto wallets due to malware threat.
If you can point me to somewhere non-timing-safe AES is in active use in an adversary-interactive setting, please let me know so I can take a look!
As a hacker, always try the easiest things first. It's crazy how often they work.
[0] https://research.kudelskisecurity.com/2023/03/06/polynonce-a...
Every tech company maintains a select cadre of hot-air specialists whose chief responsibility is to keep the catered lunch warm with an endless cycle of self-important discourse.
A vital role, truly indispensable.
This needs to be a disclaimer on every discussion of "quantum computing."
I'm not disputing that these later became the building blocks for computers, just as the quantum gate experiments being conducted in laboratories today may become the building blocks for quantum computers in the future. But that's not where we are now.
The only downside of the PQC algos is that they don't nicely fit inside packets. So just design newer protocols that don't rely on discrete packets, most of them do that already.
It ignores the requirement that secret data needs to stay secret for 30 years, or 100 years, or long into the future, and attacks only get better.
https://www.schneier.com/blog/archives/2009/07/another_new_a...
> They also describe an attack against 11-round AES-256 that requires 2^70 time—almost practical.
>> AES is the best known and most widely used block cipher. Its three versions (AES-128, AES-192, and AES-256) differ in their key sizes (128 bits, 192 bits and 256 bits) and in their number of rounds (10, 12, and 14, respectively).
>> In the case of AES-128, there is no known attack which is faster than the 2^128 complexity of exhaustive search. However, AES-192 and AES-256 were recently shown to be breakable by attacks which require 2^176 and 2^119 time, respectively.
What data has to stay secret for 100 years?
To extrapolate backwards, was there anything in 1925 that would be still sensitive today? Its hard to imagine.
You are never keeping that secret against an interested adversary.
The fact you don't know about these might in fact simply indicate the efficacy of the secret keepers.
This feels like a bad argument for religion.
The point though is not that i don't know any but that i can't concieve of any. I can't even imagine such a scenario, even hypothetically.
I'm confident there's fairly mundane multi-generational secrets, without having to summon the illuminati or knights templar. Either way it doesn't negate the interest in having a technology that could provide that.
I feel we're coming full circle towards the original discussion about pqc.
(Also, I feel cryptography is very much a tech that can assist you in keeping secrets at rest.)
If you want your secret to last more than one human lifetime, you have to enroll new people into the system somehow.
My main argument would be that cryptography is mostly useless in such a scenario. It makes much more sense to put the secret in a filing cabinet, put a lock on the filing cabinet, and if you are really paranoid, maybe hire some people with guns to guard it. Cryptography for such a scenario is the sort of thing that happens in movies not real life.
And even if cryptography was used, it doesn't seem like public-key would be very applicable at all, so pcq is extra irrelavent.
The Voynich manuscript is likely a despairingly poor example of any argument, but it's the most famous long-lived / unresolved encoded text I could think of. (I think a year or two there was a claim it was properly decrypted but I'm not convinced it ever will be, mostly because I suspect it wasn't ever meant to make sense.)
Back to the key rotation question - I think we agree that's not a necessary requirement.
PCQ is almost exclusively about public key crypto since traditional symmetric crypto is already quantum safe (with a caveat that you might need to double key lengths to reduce risk from grover's algorithm)
Because that was the number the person i was responding to gave.
In any case north korea has the bomb. I think the secret is out. The most difficult thing at this point is the engineering challenge not the book knowledge.
There is plenty of reason to want to keep diplomatic and military communications secret for a long time.
>There is plenty of reason to want to keep diplomatic and military communications secret for a long time.
I don't think that makes sense. Why would you want to keep implicating communications around for 100 years? Wouldn't you just destroy them?
Cryptography isn't useful for secrets you want nobody to know. Its useful for secrets you want some people to know but not others.
That said it also seems questionable how much people care about atrocities hundred years after the fact. For example, nobody is boycotting IBM today for their role in the holocaust.
> They also describe an attack against 11-round AES-256 that requires
> 2^70 time—almost practical.
In 2009, a new related-key attack was discovered that exploits the
simplicity of AES's key schedule and has a complexity of 2^119. In
December 2009 it was improved to 2^99.5... However, related-key attacks
are not of concern in any properly designed cryptographic protocol, as
a properly designed protocol (i.e., implementational software) will
take care not to allow related keys, essentially by constraining an
attacker's means of selecting keys for relatedness.
(Note that the attack with time complexity 2^99.5 also requires 77 bits of memory, or ~16 ZiB, which is, um, billions of terabytes of RAM? edit: actually, this is 2^77 blocks worth of memory, so add a couple more orders of magnitude.)
To date, the best unconditional attack on any full variant of AES provides a factor of ~4 speedup, although it requires 9 PB of data just for AES-128.
Cryptanalysis has already made a few strides on breaking RSA more quickly, and I've heard from noted cryptanalysts the claim there's a significant chance RSA will be further broken in the next decade regardless of PQ. It's a scary take to double down on RSA of all things.
I get what they are saying: There is a difference between theoretical and applied.
I think the OWASP/NIST/InfoSec has always been a bit behind because of this mentality. I think there is a progressive forward looking mindset that is often seen as "mad" or "unhinged" when it's ultimately throwing paint at a wall to see what sticks.
The driver is curiosity but then someone comes along and applies CBA and ROI, and CAC...the person who was curious has left because that wasn't the goal. Eventually something will stick that meets all of those mainstream ideas.
If you think of the body as a computer, it communicates through DNA, a much larger scale of information passing. Binary is just arbitrarily selected because it was there. Should we stop exploring binary computational systems? No but we also don't need all our eggs in one basket.
this is a really cool presentation to read regardless if people agree with it or not. regarding the QC stuff ... i no idea.
I get it must be annoying to be someone working in cryptography and always be hearing about QC when there are endless security issues today. It must be tiring to have all these breathless pop-science articles about the quantum future, startups claiming ridiculous timelines to raise money on hype, and business seminars where consultants claim you'll need to be prepared for the quantum revolution changing how business works. I feel the same way.
But you shouldn't let that drive you so far in the opposite direction that you're extrapolating fun small quantum factoring experiments from a decade ago to factoring 1024 bit keys in the year 4000. Or say things like 'This makes the highly optimistic assumption that quantum physics experiments scale linearly... the evidence we have, shown by the lack of progress so far, is that this is not the case'. If we get fault tolerant QC of course it scales linearly and it seems embarrassing as a computer scientist to not understand the difference between constant and asymptote. "Actually, quantum computers are so new and untested that they really qualify as physics experiments"... yeah? And?
None of this is to say that fault-tolerant highly scalable QC implementing Shor's algorithm is just around the corner, I truly believe it's not. But the world of QC is making really interesting advances running some of the coolest experiments around and I find this superior Hossenfelder-like cynicism in the face of real science making real progress so so tiring.
There is real opportunity cost to doing this stuff, and real money getting sucked up by these grifters that could be spent on real problems. There are real PhD students getting sucked down this rabbit hole instead of doing something that actually does make progress. There is a real cost to screwing around and making promises of "next decade."
But it doesn't necessarily follow that you can dismiss the actual underlying field. Within the last five years alone we've gone from the quantum supremacy experiment to multiple groups using multiple technologies to claim QEC code implementations with improved error rates over the underlying qubits. People don't have to be interested in these results, they are rather niche (a little community as you put it), but you shouldn't be uninterested and then write a presentation titled 'Why Quantum Cryptanalysis is Bollocks'.
And by the way, about 0.01% of the grifters in the QC space are getting called out right now.
How are you measuring "real progress"?
> People are still publishing papers, but they have done nothing with an effect outside their little community.
Having an effect outside the research community is essentially a Heaviside function. Before the field is mature enough, there is no effect outside, but once the field is mature enough, there is an effect outside. Makes it hard to judge if there is any progress or not.
Real progress in this field is very easy to measure. It's based on number of effective qbits of computation. That is just a metric where QC is failing to deliver so badly that everyone in the field wants to deny its existence.
Unfortunately, the level of investment in QC is very much outsized compared to the level of progress. These things should rise at the same time. More promising areas of science can get the investment that is otherwise being sucked into QC.
> Having an effect outside the research community is essentially a Heaviside function.
This is something that people like to say but is never true. Impact on the outside world for new technologies is almost always a sigmoid function, not a heavyside function. You should see some residual beneficial effects at the leading edge if you have something real.
Plenty more progress measures (decoherence, gate fidelity/error rates) to use that we have made significant progress in over the last 10 years.
Not working for years upon years, and suddenly it works, and if it does it can be a huge problem. I don't know if I trust PQC though, but that only means that more research on it is needed.
- Crypto building blocks are important basic research because it underpins everything.
- Good crypto (this exists btw) is impossible to beat, unless QC is available. That's why PQC is being researched. Think about what kind of crypto NSA wants to break, it's not your bank of america passwords.
- IDK why this guy thinks we need to shut down Los Alamos to do crypto, does he not think the NSA has datacenters of its own?
- The problem with "well, it's not a problem now, why are we preparing for it" is that nation states are storing everything that is going on in the internet, waiting for when QC becomes active. This essentially means you can assume every secret you have will not be secret in 10/20/50 years. Your password is probably fine, but if you sent secret diplomatic cable today, it might be unlocked for your adversaries some years later. These secret nation-state comms are designed to be unlocked after N years normally since keeping them secret forever is expensive; PQC is simply designed to withhold that number N.
- The NSA is generally known to be several decades ahead of the academia. They infamously knew and corrected a differential cryptography vulnerability in DES long before differential cryptanalysis was known in the public community. Saying QC isn't growing fast enough doesn't mean much.
- The 2008 financial crisis metaphor is the only one that seemed poignant
I'm not very bright, what kind of encryption does NSA want to break?