How Quantum Computing Will Change Browser Encryption
Since that paper was published, new algorithms have found currency in the community. However, the process of choosing one is a little like auditioning actors for the lead role in Hamlet. You quickly find that none are perfect and, in fact, some suffer from facial warts!
Current Candidates for Post-Quantum Asymmetric Encryption Algorithms
Several candidates are already being discussed, all of which have chosen key sizes that achieve the 128-bit level of security necessary to be quantum-safe. (Because the maths involved in each are complicated enough to boggle the mind, we won’t attempt to describe them here but provide instead the relevant Wikipedia links and wish you the best.)
NTRUEncrypt.14 One of the first post-quantum algorithms to gain notice was the NTRU (cutely pronounced “en-true”) which is based on lattice mathematics. Among its benefits are a supposedly low memory footprint and decent performance. A drawback is that a patent is involved, and history shows that open source projects tend to avoid patented algorithms.
McEliece with Goppa codes.15 One novel algorithm currently favored by some in the community is the McEliece encryption system. McEliece is the first algorithm to use randomization in the encryption process rather than in the key generation process, where most systems use it. One of its benefits is that it is faster than RSA, but its primary drawback is its huge keys. A typical RSA key is 2048 bits; a McEliece key is 512 kilobits! That’s 256 times as large!
Ring Learning with Errors. Another promising post-quantum key exchange method is Ring Learning with Errors (RLWE).16 It solves problems in field/set theory, and can also be used for homomorphic encryption,17 which is another darling at the crypto community ball. RLWE uses keys of 7,000 bits which, unlike McEliece keys, are in the same order of magnitude as today’s RSA keys.
Google actually publicly experimented with RLWE by combining a popular elliptic curve algorithm (Curve 25519) with a variant of RLWE called “New Hope.” A small fraction of Chrome browsers and Google servers (must be nice to control both sides of a TLS conversation) negotiated their key exchanges using this combined algorithm, which they dubbed CECPQ1.18 Google did not find any impediments to CECPQ1 other than an additional 1 ms delay, likely due to the larger key sizes. However, it has since ended its experiment with New Hope and is waiting for the IETF TLS committee to name a post-quantum winner.
Which is the Likely Winner?
The likely winner is an algorithm with a spectacularly bloated name: Supersingular Isogeny Diffie-Hellman (SIDH) key exchange.
SIDH has fewer warts than the other “actors” being auditioned. It:
- Uses the smallest key sizes of the candidates (3072-bit public keys)
- Can support forward secrecy
- Is free of patents19
SIDH is not perfect, though: some researchers have already been poking holes at it and have come up with some pretty disturbing attacks. The attacks can be mitigated against, but they add a whole new rash of warts.20
Related and Relevant IETF Projects
The IETF TLS working group has already started design work to fit a post-quantum algorithm into TLS. At the 93rd IETF in 2015, William Whyte proposed a hybrid handshake. Like Google’s CECPQ1, Whyte’s proposal uses a classical key exchange for half of the key, and a post-quantum key exchange for the other half. The two halves are then combined into a key derivation function to get the final master key, from which the rest of the session key data is derived.21
Conclusion
If it seems unlikely that any of these warty algorithms will make a good Hamlet, well, that’s okay. Many people in the crypto community are skeptical that a large-scale quantum computer is even possible. The largest number that’s been factored yet by the embryonic quantum computers is only 56,153.22 And that one was found accidentally; the researchers were only trying to factor the number 21. Twenty-one! That’s a far cry from factoring a typical RSA key.
Largest prime (accidentally) factored by quantum computers:
56,153
Representation of a sample 2048-bit RSA prime number:
57,553,458,486,056,431,746,847,208,022,543,120,686,362,765,031,041,714,
706,428,471,160,745,235,411,376,732,672,614,710,256,143,712,875,812,775,
531,754,663,720,746,448,566,758,301,438,002,242,338,424,048,764,872,084,
322,538,104,276,565,005,305,068,287,261,643,106,164,817,447,336,476,857,
633,361,313,702,487,483,684,380,181,504,352,488,756,401,348,372,666,675,
170,251,071,165,745,054,740,314,876,413,585,322,633,744,563,452,103,886,
563,380,208,134,638,771,150,750,348,252,338,443,643,674,024,137,867,731,
002,408,242,866,628,372,342,027,620,557,363,331,318,028,008,145,183,701,
081,845,364,150,033,761,083,575,482,476,712,010,033,513,666,101,161,535,
836,220,061,577,885,841,174,131,502,207,784,487,008,265,433,306,023,331,
401,716,233,713,633,513,551,554,050,487,048,463,525,706,858,664,265,067,
836,315,562,453,368,638,716,031
So, quantum computing still has a way to go. But if it really does become a thing, we’ll be (sort of) ready for post-quantum in pretty short order, at least from a protocol point of view. Adoption will take forever though, as usual.
Get the PDF version of this report: click “Download” below.
Source link
lol
Since that paper was published, new algorithms have found currency in the community. However, the process of choosing one is a little like auditioning actors for the lead role in Hamlet. You quickly find that none are perfect and, in fact, some suffer from facial warts! Current Candidates for Post-Quantum Asymmetric Encryption Algorithms Several…