Slashdot Mirror
NIST Asks Public For Help With Quantum-Proof Cryptography (securityledger.com)
chicksdaddy quotes a report from The Security Ledger: With functional, quantum computers on the (distant?) horizon, The National Institute of Standards and Technology (NIST) is asking the public for help heading off what it calls "a looming threat to information security:" powerful quantum computers capable of breaking even the strongest encryption codes used to protect the privacy of digital information. In a statement Tuesday, NIST asked the public to submit ideas for "post-quantum cryptography" algorithms that will be "less susceptible to a quantum computer's attack." NIST formally announced its quest in a publication on The Federal Register. Dustin Moody, a mathematician at NIST said the Institute's main focus is developing new public key cryptography algorithms, which are used today to protect both stored and transmitted information. "We're looking to replace three NIST cryptographic standards and guidelines that would be the most vulnerable to quantum computers," Moody said. They are FIPS 186-4, NIST SP 800-56A and NIST SP 800-56B. Researchers have until November, 2017 to submit their ideas. After the deadline, NIST will review the submissions. Proposals that meet the "post-quantum crypto" standards set up by NIST will be invited to present their algorithms at an open workshop in early 2018.
So, they want a code less vulnerable to math... good luck with that.
This is a bad idea. We're in a weapons race, and so long as we keep playing the game, successive generations of crypto will be subject to attack. We need an end-run around the problem, which means changing how we think about encryption and data security.
Encryption should begin with a physical exchange of one-time pads. If you open a bank account, you should get a key to it. The key is an exhaustible one-time pad you use to encrypt transmissions to and from the bank. You plug it into a machine which runs packets through it.
Real lawyers write in C++
NIST are hardly credible at this point, they previously were involved in the Dual EC fake random number generator, and now they're an agency under the Executive of Russian puppet leader, Trump. No credibility, means no trust.
FBI has demanded backdoors, Trump has said he'll give them their backdoors. NIST are the backdoor implementers.
So there is going to be lag between when Quantum Computers can decrypt classical based algorithms and when Quantum Cryptography can be used. They must think it's long enough to find more robust classical algorithms. Probably not going to help.
https://en.wikipedia.org/wiki/...
They can write me a check.
They are the sheeps in the wolves clothing here. They well not allow anything they can't break.
Time is what keeps everything from happening all at once.
so why are they still around if the Public constantly has to rectify them?
Banking with your local bank branch, fine.
Sending in an online application to a graduate school a thousand miles away, not so much.
Okay, I take that back: Physical "in person" key exchange could be done if you did your key exchange "in person" with agents acting on the other party's behalf, with the key sealed in a tamper-evident packaging and optionally encrypted with your public key. Oh way, scratch that optional part, or we will be reasoning in circles.
Besides, one-time pads can be compromised.
I do agree that a combination of one-time pads and public-key encryption - with the pads being encrypted with short-lived public keys - are preferred for some uses, such as setting up a bank account in person, than the current system.
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
Codex idioca.
Greetings!
gHZ1Ln82hulupzy me the king prime. Red. 11111111111111111111111111111111111
Sticks. Beans. Floggernoggin.
There are critical errors in the measurements of my Harold stated that when he First saw cars on roads tend to speed excessively.
>>.2-/
The dated frog.
Here's a good wikipedia page https://en.wikipedia.org/wiki/... summarizing the known approaches. Interestingly, most symmetric encryption schemes seem to be secure (you just need to increase the key size apparently): it's the public/private schemes that are in trouble.
They can take pretty much any concept and turn it into a hopelessly indecipherable mess that nobody else would ever be able to understand without guidance from the writer.... so I'm thinking they must be onto some pretty sophisticated encryption techniques right there.
File under 'M' for 'Manic ranting'
If you did nothing wrong, you would have nothing to hide, right Mr NSA?
So do nothing wrong, then you won't have to hide anything. ...oh, that only applies to the common vermin. Apologies.
Suppose that that Bob and Alice have a secure channel now, that they will not have in the future. They will have an insecure channel in the future. A OTP allows them to exchange messages now, that have not been written yet! A OTP is a message time machine. It allows you to securely exchange a message now, that you intend to write in the future.
After they exchange a OTP, if either Bob or Allice gets hacked, so that the OTP is surreptitiously exposed, then that is equivalent to exposing a message that has not been written yet.
The proper way to think about OTP is not as a crypto algorithm, but rather as a message time machine.
A strange game. The only winning move is not to play." ~ War Games - 1983
Encryption is not the solution; it's the problem.
Quantum computers can't do a goddam thing better than what we already do except faster.
The best new approach is to change paradigms.
I'm not 16 anymore and I don't have enough time left to figure it out.
That's the way to go, though.
The problem with security today is the fucking DNA of the first computer ever built.
The first automobile should have had seat belts.
It little behooves the best of us to comment on the rest of us.
I'm not sure I 100% understand this (but then it was Dr. Feynman who said that if you think you understand quantum mechanics then you don't)... but I read this 2002 paper by MS research that gives a method of transforming biprime factorization into an optimization problem. Optimization problems are exactly what D-Wave's quantum annealing machine can do (very well)... so doesn't this kind of break RSA? Can somebody point me to the place where I can learn that I'm wrong and can start trusting RSA PKI again?
21=3x7
You are going to crash the simulation by forcing the universe to perform such expensive computations!
I'm not up on cryptography but from what I understand most encryption standards have a way to tell if a data set is decrypted correctly. Correct?
So couldn't you implement a cypher that has no way to verify the result -- put in a key, any key, get an output file. If the proper key is used the output file is an encrypted file that can be decoded using another key, and a different encryption system that does a check for correctness.
Wouldn't that greatly increase the difficulty in cracking the code? The file would have to be decrypted using every possible key and then each of those files would have to be hacked, but only one of them would actually be the correct file to decrypt so the other 99.99...% of the files would be unhackable because they would be garbage.
Or would the same effect be had by just using a longer key?
"Grab them by the pussy" -- President of the United States of America
It sounds to me like you've simply doubled the length of the key. Actually slightly worse than that due to collisions. You'd be more secure encrypting 128 bit blocks with a 128 bit key than encrypting a 64 bit block with a 64 bit key, then with another 64 bit key.
It should be noted that making the key twice as long does NOT make it twice as hard to decrypt. Rather it SQUARES the time required. A 129 bit key takes twice as long as a 128 bit key (assuming blocks are long enough etc.) So your idea DOES make it much harder to break - exactly like a longer key does.
Unfortunately, it may be that in 30 years a quantum computer will be able to break 1024 bit Diffie-Hellman in a picosecond. 2048 bit would then probably take much longer - many seconds or minutes.
Unfortunately right now we're trying to defeat the capabilities of machines that don't yet exist, so we don't know their capabilities. Recall the president of IBM said "I think there is a world market for maybe five computers." Twenty years later, there were hundreds of thousands of computers sold every year, and a decade or so later was the Apple ][. Predicting what the next generation of computers will be able to do is *hard*.
I found Bob and murdered him. I have the codes, now what? Can I get your data?
At one position in space/time the fire from kerosene can melt steel beams, whereas the same steel beams elsewhere in the universe do not melt under identical conditions. Surely NIST can use this concept to provide real national security.
Let's just assert a hard limit to the complexity of any physical interaction.
As a mathematician who occasionally works on cryptography problems, I read the statement, provided in the link, at the Federal Register, some thoughts:
1) Quantum computers are a distant reality. From my understanding, they are still mostly theoretical. Those that do function, can only perform basic arithmetic -- or the equivalent -- or aren't considered fully quantum. So, it would have helped to define what quantum cryptography is. Presently, a key size, from my understanding, that's needed to prevent birthday problem attacks (that is, brute force) is 2^90. Probabilistically, this is the equivalent of 1. What then is optimal key-size needed in quantum cryptography?
2) Why can't present methods, such as block ciphers, be used to significantly expand the key size? DES, for instance, was once considered secure and is not. 3DES, however, is now considered secure.
3) Why would a cryptographer, or a company, want to work with NIST? Although the theoretical and applied work at NIST is obviously important for cryptographic applications, NIST does have a reputation of vagueness. For instance, it's widely believed that the S-box, for AES, was designed by NIST as a method for providing backdoor access to American government agencies. Also, the elliptic curve designed for a NIST-approved key exchange doesn't list the mathematician(s) who worked on it and doesn't provide any transparency on how it was developed. (Note: this information is several years old and may be out-dated.)
more than half of the population has their brains damaged by watching the Kardashians, Reality TV, and Trump related trash...
If you want unbreakable crypto... One time pad.
and here someone says "but MOOOOOM its hard!"... no it isn't.
How many gigs of communication do you need to secure per device? Lets presume that there are LEVELS of security that can be secured with varying levels of security.
Naturally it is impractical to secure everything with the one time pad type encryption. Which to be clear would be a very large file stored on the sender and receiver and the data being encrypted would use only a portion of that seed data to randomize the information you wanted secured. And any portion of the "pad" that was used would be blacklisted from future use. So what would I use with something like this? Well, how about using the one time pad to encrypt new encryption keys. Thus encrypt/decrypt keys, seeds, etc would be secured by one time pad. Transferring the new pad could be done physically if this is really high security thus bypassing networks that are demonstrably compromised enough that you want to encrypt your data over them.
One time pads are already used by the government for the highest level security. Nuclear launch codes for example are one time pad. A lot of the shoe leather and handshake intelligence networks run on one time pads.
There is no reason we can't translate this even more easily to the digital sphere than it is in the wink and pistol sphere. Let us say you have a file that contains something like 32 gigs of randomized "one time pad" data. Using 1:1 encryption that could encrypt 32 gigs of data you want to secure. And breaking it would be basically impossible. No repeating patterns. You need the one time pad data to decrypt. Period. Look at text messages from cell phones. If we WANT to be efficient with our data transmissions, we can be.
Let us say what we want to do is sync two databases over the internet and the data in these databases is very very sensitive. Now we could use the one time pad data sparingly... passing only some data through that system. Maybe just encrypt/decrypt data for some other encryption scheme. Possibly certain aspects of the data would be encrypted using one time pad. Maybe not all the data being synced has the same security clearance. The point is that if you need to be efficient about it, you can be.
And if you want encryption that can't be broken. One time pad.
Now I assume that isn't what they want. They want some fire and forget, cheap as dirt, flawless, idiot proof system they can slot into the system and stop thinking about this ever again.
That is a fantasy. I don't see that happening.
I've decided to stop wasting my time responding to AC trolls/sockpuppets... so if you want a response from me... login.
Why verify the really at all? The recipient will know whether the response is nonsense or not. This may not be a good method of authentication/validation, but with trillions of decrypted "solutions" to go through... Maybe a machine learning algorithm could pick it out, but otherwise it's a needle hiding in a huge haystack...
if you want to crack encryption with a powerful computer, you need a means to algorithmically verify your guesses. This is what you need to make hard. Essentially you need a way of encoding messages such that there are many many plausible decryptions. As such, if you took a dictionary of the most common 5000 English words, and forced all communications to use those, and only standard English grammar, you could algorithmically map strings of integers to English words and phrases. There are many ways to do this, and many ways to permute how it does it. More importantly, it is hard to know if you've got it right (and impossible for a simple algorithm).
John_Chalisque
Who is the "you" in "your data"?
You can get the data sent to Bob, just like you would with Bobs decryption key to any other encryption system.
You may also be able get the data that Bob has sent, just like any other *symmetrical* encryption. A one time pad IS symmetric encryption (both sender and receiver has the same key). However, each bit in a one time pad is by definition only ever used once, so used bits can safely be destroyed (overwritten (18 times if you prefer)) as soon as the message is encrypted. This would prevent you from decrypting anything he has sent previously.
That was the wrong Bob. You killed an innocent Bob.
Considering the quantum computers seem to be mostly built on hype and not capable of beating regular computers in speed or cost I would not worry much about this.
The security of OTP is in destroying the part of the pad that you have used. Then if the pad is hacked, there is no way to decrypt past messages.
https://sourceforge.net/projects/gentleotp/
If I have an idea for creating encryption that's invulnerable(or extremely resistant) to attack by quantum computers, I'm going to the patent office not NIST.
The request doesn't appear to explain what they think this troubling quantum computer can and can't do.
(Except that is can run some specific algorithms like Shor's, it says little about what the range or future algorithms might be.)
Perhaps their first request should have been to get a common language for defining the threat.
For a conventional computer, the size of effort to crack is somewhat represented by the number of key bits.
For a quantum computer, a similar metric might be nice.
Especially if it gave some insight into the problem they are trying to solve.
There are three reasons to have an integrity checksum, to verify that it decrypted correctly. One issue you didn't mention is that it's always possible for an attacker to change the cipher text without decrypting it, and sometimes they can make interesting changes. You want to know if the data has been modified.
> Maybe a machine learning algorithm could pick it out, but otherwise it's a needle hiding in a huge haystack...
It's not hard for an attacker to notice whether or not the plaintext looks like: /fundstransfer.asp HTTP/1.1
GET
Host: bankamerica.com
Cookie: xxxxxxxxxxxxxx
User-Agent: Firefox blah blah blah
For data formats where a machine can't readily know if it's probably correct, such a scheme is unusable where there isn't a human interactively using the application at BOTH ends of a communication. For example, you use your bank web site to initiate a transfer. If the computer at the bank can know when the request is correct versus corrupted, the attacker can also know when it's likely correct. If the attacker can't identity a correctly decrypted transaction, neither can the bank.
On the other hand:
> The recipient will know whether the response is nonsense or not.
Maybe, maybe not. If it's supposed to be a web page, gibberish would be easy to distinguish. For more compact data formats, many incorrect plain texts will also be syntactically valid. The computer at the other end doesn't necessarily know which is correct, without a checksum indicating correctness.
His name wasn't even Bob, it was Robert. Robert Paulson. His name was Robert Paulson.
AES has already been compromised. I can't reveal the details. But, suffice it to say this NIST cry for help is much too late.
You need to start with Alice and Bobs cat.
Microsoft already did this.
Do we the tax payers have to pay the government to make free (and probably bloated, not working) versions of everything?
I don't see why anyone uses NIST outside the government. Almost no one does unless they have huge budgets not requiring profit.
It should be noted that making the key twice as long does NOT make it twice as hard to decrypt. Rather it SQUARES the time required.
This only applies to symmetric keys where doubling the key length squares the search space. For RSA, the ballpark is doubling the key size increases its strength by 50% (1024-bit RSA = 80bit AES, 15360-bit RSA = 256bit AES), and quadrupling the computational costs each doubling of key size.
It seems to me that the key lengths cannot be finite for something post-quantum and thus must end up being some sort of (lispy (program)) that is a lazy-sequence (returning specific values only on demand) of all the [infinite] key bits. So your cryptokey is _alive_ *laughs like doctor frankenstein*
Thanks for pointing that out.
Can God create a rock so heavy that He can not lift it? OK so quantum computers can solve problems that appear to us to be of infinite complexity. So could a quantum computer be programmed to create a password of an even more complex infinity ? I still like the idea of a ladder of passwords being created such that every rung of the ladder need be answered in frequent, quick steps. That way even a quantum computer could not solve the password fast enough and the first rung of the ladder would change every time it was addressed. Think of it like the spokes on a bicycle wheel that is in fast rotation and you have to enter on the moment that a certain spoke comes to a mark and then rapidly supply the passwords before the next spoke arrives in position. Only when each spoke is decoded at the proper, small instant, can the site be opened. Making it even more complex, each spoke may have a code that defines which of the other spokes is opened such as every fifth spoke. But after landing on the fifth spoke three times it lands on another spoke that now demands every twelth spoke be opened in order of appearance. I think such a complex system could work to a degree that no quantum computer could run long enough to solve the password. Keep in mind that that bicycle wheel could have a very large number of spokes.
There Came An Echo, anyone?
Even a quantum computer can't break a (properly) created, safeguarded, and used, ONE TIME PAD CIPHER.
Just saying.