Join the discussion
Write your take first — we'll ask for email only when you're ready to publish.
- Hacker News
- TBF it's the healtiest approach to it. It's just risk mitigation. Nobody cares about it - there are nice papers to implement it ; just freaking do it.by 6r17
- Will they decertify previously certified PQC-free products?by vaadu
- Qualification is time-constrained. You are qualified for two to three years. So by 2030, all qualified products will be PQC-free.by roblabla
- I'm very curious how much people will look back on this frenzy of PQC migration panic by 2050 when, my bet, there still won't be any remotely viable QCs. The decade plus of even slower TLS negotiation that this will bring in the name of "security", after so much time spent previously on improving encrypted connection latency, will seem quite comical, at least.by tsimionescu
- Most fire hydrants are never used either, but we don't consider them wasted.
In your opinion, what chance of QC would warrant PQC migration? Would you be ok with a 20% chance of everyone being caught unprepared? 30%? 50%?
Keep in mind the impact is "hackers can take control of almost all online infrastructure and forge almost any document".
by BoppreH - Y2K devs had it easy, they knew the bug would arrive and when.
The problem with PQC is not that nobody knows when a CRQC (cryptographically relevant quantum computer) will appear, but that by the time it appears, you are already ~10 years too late for migrating (5 years of migration time and 5 years of your adversary silently storing all your classical crypto messages to decrypt them at a later time, the "harvest now decrypt later" attack).
Of course the HNDL attack is only relevant for the most critical pieces of infrastructures, 99% of companies are not a real target for that, especially given the storage cost of such an attack.
There is also the "trust now, forge later" attack, in which a CRQC could break a chain of trust (i.e. digital signatures), and that attack does not need any storage besides the logs of past messages. If you want to guarantee authenticity and unforgeability of your logs for, say, 20 years, you better hope that no CRQC appears by 2050 at least. Once again, it only concerns maybe 1% of companies.
But hey, these 1% companies are exactly the ones that are needing specialised crypto equipment so the move from ANSSI tracks.
I personally do not believe a CRQC will appear before 2050 either. I am willing to bet some money on it, despite researchers in quantum computers being quite confident it will appear in the next 15 years, but I am not willing to bet the entirety of Internet security on it.
by plopilop - I don't think the TLS negotiation will become meaningfully slower, as there are multiple threads being pulled on for how to make post quantum happen here with minimal regression, instead it will likely become meaningfully more complex and only slightly slower, continuing a trend that has been ratcheting for quite some time now. ECH and modern certificate revocation checking schemes are also contributing to this.
The increase in complexity is a huge problem. It is arguably justifiable but simultaneously concerning. It's already quite hard to make a correct TLS implementation as it is.
(Personally though, I still like post quantum encryption. It's a nice hedge in case ECC and/or RSA do fall any time soon, whether by quantum computer or simply math.)
by jchw - It's only reasonable to call past decisions comical when you can look back and say there was certainly no reason to have ever been concerned at the time with the information and certainty of the time, not whether or not it actually turned out that way in the future and you get to judge the response with the outcome already in hand.by zamadatix
- I wouldn't categorize it as a panic. Standards and security organizations are recommending moving to PQC based on projections of capability. CloudFlare and Google recently moved their timeline forward for PQC migration based on new data[1][2].
1. https://blog.cloudflare.com/post-quantum-roadmap/ 2. https://blog.google/innovation-and-ai/technology/safety-secu...
by krisbolton - I'm logging into websites using unique passwords with 44 bits of entropy, which they feed into a hash algorithm that takes 200ms to hash each attempt, then entering a TOTP code or touching my Yubikey, and they check against my geoip history and fingerprint my browser and they want me to complete a captcha and they e-mail/SMS a one-time code to me and they send me an e-mail telling me there's a new login to my account.
The security industry loves to use belt and belt and braces and braces and braces. If they add an extra belt or two, I doubt anyone will remark on it at all.
by michaelt - You prepare for the 9.0 earthquake that can happen once in 500 years because it is a 9.0 earthquake and if you haven't prepared your society is dead, not because you think it will most likely happen in your lifetime.by jmward01
- It really depends on the market you are targeting and your threat model. If your threat model allows future decryption of the data by a passive listener, then you don't need to rush for PQC. If you are worried about your communications being archived for future decryption, then you need to deploy PQC now even if QCs aren't developed for decades (or ever).
The assumption that you care about this is baked into ANSSI certifications, otherwise you would usually not bother certifying your product. They warned in 2022 that they would do this (See Phase 2: https://messervices.cyber.gouv.fr/guides/en-anssi-views-post...) and will allow PQC-only algorithm no earlier than 2030.
by Sayrus - I was at ANSSI headquarters last year doing a technical presentation and several of their questions were about Post-Quantum Cryptography, "Q day" (when a practical Quantum Computer is expected) and other related things. They keep a close eye on this stuff and it's to their credit. Similarly the BSI in Germany have been promoting Post-Quantum security for some time now.
I work at AWS, where we have been deploying Post-Quantum Cryptography for quite some time and have experts. We're making easier than ever, but the sudden changes in deadlines do make me wonder how many companies are going to have to spend more time than they'd planned on migrations and settings. The "context switch" of working on PQ can be quite expensive. Most tech people have no idea what ML-KEM, ML-DSA, or HQC are, or how to not worry about SHA, HMAC, or AES. It's going to be a ride!
by colmmacc - Related: https://news.ycombinator.com/item?id=48992806 (Are 128-bit symmetric keys really secure against quantum computers?)by cold_pizz4
- From TFA: "The policy reflects growing concern about Harvest Now, Decrypt Later (HNDL) attacks, in which adversaries intercept and store encrypted communications today with the intention of decrypting them once a cryptographically relevant quantum computer (CRQC) becomes available."
Once it gets to be "later" where the harvest data is able to be decrypted, I guess will have decent enough LLMs to summarize all of that data? Otherwise, there's going to be such a huge back log to make it not too useful
by dylan604 - I mean we have decent enough LLMs and algorithms to classify it pretty easily now, much less the future. Just getting context information on who or what the data is narrows down a lot of what you want to look at.by pixl97
- PQC: Post-Quantum Cryptography.
The concern is systems which won't be resistant against quantum cryptographic attacks.
The US's NIST has an explainer page, "Post-Quantum Cryptography PQC":
by dredmorbius