cryptography detours delays and
disasters
um
all right thank you
let's see if I can move this over to the
acrobat window here
okay
so we gave a talk on post Quantum
cryptography at hidcon 20 and it's been
in the news a lot so we're assuming that
people are generally familiar with it
but just one slide of a reminder of the
importance of post Quantum cryptography
the general situation is you're talking
to a web server through https and then
TLS transport layer security is supposed
to be guaranteeing that you're talking
to the right web server and this is
something that does with a cryptographic
tool of public key signatures for
example RSA signatures now it's also DLS
is supposed to be protecting your data
against being understood by the attacker
the the attacker is listening to
everything that you're sending and even
without pretending to be the server the
attacker can record your data and look
at your data and see all your secrets
and so TLS also uses public key
encryption for example nist p256
elliptic curve cryptography and this
public key encryption is replacing your
data with encrypted data ciphertexts
which the attacker has trouble figuring
out what those psychotypes be now this
public key cryptography public key
signatures and public key encryption is
not the only cryptography used in TLS
because for performance TLS also uses
symmetric key cryptography which is much
faster than public key cryptography so
almost all of the data that you're
sending is actually encrypted with
symmetric key cryptography using a
symmetric key which is secured using
public key cryptography and also TLS
authenticates your data protects it
against being Modified by the attacker
using symmetric authentication which is
well signed using public key signatures
so there's a little bit of public key
signatures and encryption at the
beginning of your connection and then
there's lots of symmetric encryption and
symmetric authentication to make sure
that your data all of your data is
secure after that if any of these pieces
are broken then TLS the attacker can
pretend to be the server or can see and
understand the data that you're sending
now this is where the post Quantum
problem comes in first of all
as soon as the attacker has a big
quantum computer the attacker can break
rsf and can break elliptic cryptography
and so post Quantum cryptography says
well
what do we do to make sure that the
attacker we need to replace RSA and well
elliptic curve cryptography with
something that the attacker cannot break
all right and so already 2016 I was
giving these talks so this is a
screenshot from a talk I gave him May
2016 at a conference about
standardization of cryptography and I
was highlighting how important it is to
move to postpartum cartography so Dan
was already saying that all the
connections have the public key
component which is broken and so that
means today's data if anybody's
recording it and we know that there are
large scale attacks which who are
recalling all the communications going
on then they can decrypt this
communication from today sometime later
with the quantum computer and there are
lots of
kinds of data medical records legal
proceedings State Secrets company
secrets and so on that have a long data
lifespan where you still want secrecy
for many years and so it's actually very
important to move to post-con
photography sooner than later
an important message I was giving 2016
is that we actually have some secure
systems
they're not as convenient as the current
systems they're somewhat slower somewhat
bigger as you can see at the bottom left
here the logo of the post of the people
project was taught voice actually a big
Galapagos tortoise which is not known
for its agility but it's known for
living a long time and being very very
solid
and so what we were working on was
making nice and faster ones but people
could move to something secure and so
when I was answering the question about
like sanitization now or later was that
their arguments in favor of either kind
of standardization now because well it
takes a long time and we have to get
ready
also standardization later would have
arguments namely that we will have
better system to standardize but the
main message I was giving is well yeah
we can start standardization now but
it's really really important to have
sold recommendations so that people who
need to secure their secrets all the
data that's going on with the wire today
can do so and it was not just talking we
had actually several months before in
September 2015 got together with several
senior people in this project and said
okay
if we put our knowledge together all the
things we know about attacks all the
things we know about security
what are systems that today well now
that's eight years ago but almost that
we can recommend and say those are solid
systems and so these are the systems
which back then and still today we're
saying these are very secure long-term
recommendations so for symmetrical coach
actually nothing is changing so much
well the key size up here for
recommending 256 bit keys so this is
something where you still see a lot of
128 bits but there are many reasons to
move to 206-bit keys anyway and so any
system like as or sell the trendy or
Chacha 20 that you would find today in
the internet anyway useless 256-bit key
indicator same for the Authentication
so these were the last two things on
that side of our TLS also here's
something that we're using currently and
you're fine and then for public key
encryption the two kinds of systems we
are recommending were systems that have
aged very well and have been studied for
many many years so those are systems
from the late 1970s maclease from 1978
and hash based signatures from 1979. so
those were systems which in 2015 were
already look those have been studied so
long time you can just use them
and so well plus that meant we have
gotten people a good recommendation so
they can go and secure the important
data and we can do some research on more
efficient nicer systems and we thought
okay everything is good
except well let's look at what actually
happened starting in 2016 where Google
did try putting a system out um so
Google in the Chrome browser said let's
try experimenting with post Quantum
cryptography so they said let's take New
Hope 1024 and this is a post Quantum
system and they put it into the browser
they put it on some of their servers and
did an experiment to see whether it was
working and the experiment seemed to be
going fine now they said they're not
just going to turn off current
cryptography they're not going to turn
off elliptic curve cryptography what
they said was they're going to encrypt
everything with elliptic curve
cryptography and they're going to
encrypt everything with this post
Quantum proposal New Hope and the reason
for that is that if something goes wrong
with New Hope if it ends up being
completely broken then well we still
have current security we have elliptic
curve photography still protecting us of
course this is failing to protect
against future quantum computers if that
happens but what hopefully New Hope is
is okay and definitely we still have
current ECC security so they encrypted
with both pre-quantum and post Quantum
it's very important to consider the
possibility of these post Quantum
systems being broken because while New
Hope and many other post Quantum systems
these are very new crypto systems this
is very different from what Tanya was
mentioning a moment ago systems from the
1970s New Hope was published in 2015.
using some older pieces but pieces from
2014 and 2010. so really it's very very
new this is when Google rolled it out it
was between one and six years old the
major pieces of this New Hope system
and well being a new crypto system has a
security threat it also means that oops
maybe it's patented because maybe
somebody actually figured out the ideas
that you're using and filed for a patent
on it before it was published and while
a patent holder talked to Google and
said hey you're using New Hope and
that's actually a system I have a patent
on and well a few months later Google
removed New Hope from Google Chrome
now a month after in December 2016 the
U.S National Institute of Standards and
technology part of the Department of
Commerce nist they said in one year we
want to see proposals of post-quantum
systems to standardize
and they made some different choices in
this call from what Google said so one
choice that they made was you are not
allowed to submit elliptic curve
cryptography plus some post Quantum
proposal they said you must not in any
of these submissions have any pieces
which are going to be broken by a future
quantum computer
for example they said if you have a
discrete log based encryption mechanism
that would be elliptic curve
cryptography and you combine that with
New Hope then that would not be allowed
as a submission and they set up the
submission procedure so that proposals
like New Hope would be evaluated
primarily for pre-quantum security which
is very strange because the goal was to
get post Quantum security after the
attacker has a quantum computer make
sure that the attacker cannot break
these systems we already have
pre-quantum security what we need is
post Quantum security
so this was a distraction from the goal
of post-quantum cryptography and this
call for submissions from this had other
distractions for example they had
certain security categories which is I
don't want to try to explain what these
are but these ended up really
distracting people from figuring out the
security of these crypto systems
flexibility there were all sorts of
extra constraints on what you should try
to do which were not the basic goal of
protect against future quantum computers
all right I'm surprised you didn't put
security codes here all right uh
actually some pressure to wait for this
oops yeah I'm supposed to be doing this
slide as well so
um
when uh industry for instance Google and
apple and so on were looking at the
situation after Google had trouble with
the patent and then nist was saying well
we're going to have submissions of
things to standardize nist was saying
things that sound very attractive for
companies one of the things they were
saying was they are going to collect
information from every submitter about
patents on the submissions and this said
they believe it's critical that this
process leads to cryptographic standards
that everybody can use for free so no
patents and also nist said they would be
prioritizing the security evaluating the
security so this would give the best
possible guarantees if nothing going
wrong that the security provided by each
submission that would be the most
important factor in evaluating the
submission and also other
standardization organizations looked at
this and said yeah we'll just wait and
see what Nest is doing for example in
March 2017 a few months after this was
announcing
um the ietf has their research
organization irtf and inside that cfrg
which handles cryptography they said
well okay there's some some very well
understood things where we're working on
standards but we're going to wait for
nist for everything else
and also ISO decided to wait for this
and lots of Standards organizations
decided to wait for this well not
everybody so China said we're going to
run our own competition
which I'm sure is very important for
people in China
well for the rest of us the system
addition started in this
well the end of November 2017 was a dead
loving and nist was collecting those and
really see those but some solutions were
already announced by the designers
online
and so during the next few days together
was it was then about PhD students
we were looking at one of the systems
and broke some security aspects of one
of the challenges
and then finally just before Christmas
this made us an ice present so they
posted 69 completely proper submissions
actually very good
participation too many people
um a bit surprising maybe that there
were a few of them which were I would
classify as conservative like based on
very long well studied assumptions then
again we have those already and that
might Rock be rolled out every day now
and so well it's also understandable
that those who want to win empathize
performance
now what do people with an attack
mindset do when they see six nine
submissions also student loans Money
um when they had and within the few
first few hours broke one of them where
strip breaking means he actually had
like some fighting code just Grand end
of the whole thing uh with transpired
just a few days later together with the
resulting in Logan's we broke another
one
um but no one's broke another one we
broke another one and then some other
people that started jumping in now I
should comment on those these are not
script these are more favorite attacks
but they still show
um that the designer didn't put the
security level they didn't really
understand how secure the system was and
it somewhat different and so also other
people and well it keeps going you see
like the dates are not that far apart so
the January that was quite a card I mean
you're feeling like okay this is like
capture the flag of competition and
you're just trying to break as many as
possible and just jumped in you see
sometimes it's two groups breaking the
same one or building on it on top of
things
some get broken in a few times
and continues through 2018
okay fine I'm not going to go through
all of these at the end of 2018 early
2019 this was same thing you know
narrowing the field we have these 69
submissions so like a broken 13 in total
we're like broken means there's a script
and there are actually several which
have they have security claims to
disproved as like they were not as
secure that they could keep all the
features what they did is they narrowed
them filled from the 69 26 of secondary
candidates
interestingly they kept some of those
which didn't really understand the
security levels but they felt like there
were some some benefits then some of the
remaining submissions that were emerging
um what survived okay none of the really
broken ones great
um but there was also a strong bias
towards those which were faster
so there were at this moment deselecting
some which they perceived as too slow
and well not about to win the beauty
contest
so then what happened after that in 2019
well first of all industry started
working and saying okay actually the the
situation for Rolling Out Post hormone
cryptography has changed a little bit
at the beginning in 2016 Google was very
enthusiastic and tried rolling something
out and oops ran into trouble with the
patent and then well after that people
saw the missed competition starting and
then felt like okay niftus is going to
focus on security and give us something
strong and patent-free and that'll be
great but well lots of things were
getting broken
um meanwhile at least nist had published
statements from all the submitters about
what was patented and then some things
were not broken so okay industry for
example open SSH open source software
for doing SSH connections this is the
most popular SSH software and they in
April 2019 added a post Quantum option
again one of the newer options not
something which has been around since
the 1970s and while they didn't turn it
on by default they said you you have it
as an option if you enable it in the
client and enable it in the server and
meanwhile people were breaking some more
submissions and well Google and
cloudflare a few months after openssh
Google and cloudflare said okay okay
it's time for us to try another post
Quantum experiment and they picked two
of the newer candidates and true hrss
which is a lattice based system and psyc
p434 isogeny basic system and for both
of these they did elliptic curve
cryptography and the post Quantum system
encrypting with both so that if
something goes horribly wrong if one of
these systems is completely broken at
least we still have elliptic curve
cryptography protecting us and they ran
this experiment and reported useless of
the experiment meanwhile more things got
broken and uh Google in another
department said we have a wonderful
quantum computer they announced Quantum
Supremacy and that scared a lot of
people realizing that yeah okay this is
maybe getting very serious and maybe
within 10 years we'll have a big quantum
computer and maybe attackers will have
it sooner and this is really scary
um okay more and more attacks happening
we're not going to list every uh
possible attack that happens now in um
2020 in the middle of 2020 nist said
okay out of the 26th second round
candidates we'll focus on 15 photos and
which ones did they pick well two of
this admissions were completely broken
and they did not take those also five
more submissions had security claims
disproved and less secure than they they
claimed they were supposed to be and
this did not take any of those Mist took
most of the remaining submissions the
ones that did not have attacks now 16 of
those and well two of those merged so
they ended up with 15 third round
candidates list said they are confident
in various systems but I think when nist
says confident they don't mean what I
mean when I say conquered for example
this was saying well if our confidence
in some faster signature systems is
shaken by new analysis in other words if
some signature systems are broken then
well there's this backup Sphinx plus now
that you might remember the Sphinx name
that was one that Tanya mentioned from
the 1970s okay it went through some
Evolution there was sinks 250 six and
then six plus and I mean various
efficiency improvements for example but
trying to preserve the same security
analysis going all the way back to the
1970s and then meanwhile this was
looking at all these other systems and
saying well
um yeah we're understanding how secure
these systems are for example nist
commented on Rainbow and said the key
point is not that attacks have improved
and may continue improving against
rainbow the point is the analysis is now
improved in a way that matches what we
see in experiment and so we really
understand what's going on with the
security of rainbow and then a month
after that there was a new attack which
was reducing the security level of
rainbow this is one of the signature
systems and then an attack the next
month was against another signature
system and then a faster attack which
actually was a script breaking the
smallest parameters for rainbow bigger
rainbow parameters are still okay but uh
the smallest ones are much less secure
than people expect
so maybe yes there is some issue with
sir
better performing signature algorithms
now what do other people do when there's
concerns about things not getting pulled
out Security in general so we got
together with the European cyber
security agency and visa and wrote a
document about the current state of
post-con Photography and the mitigation
of the quantum thread and so if you're
interested in some more constructive so
if you're getting depressed by all the
texts I mean don't get me wrong Edge
hacks are fun but we also have to defend
there is all this data that is being
sent over and it's insecure
we shouldn't get all distracted by
breaking some wimpses we actually have
to focus on the job of securing some
systems and so we wrote this report so
if you want to get new details about
well what was it what we what were these
15 candidates and how do they work so
there's some some short snippets on
those and also how can one move
um two secure systems so the report is
available on the Visa web page and once
the slides up you can just click there
now what happened after uh after that
well may 2021 open the SD in their ipsec
software they added a post Quantum
option again was not by default so the
client and server both had to enable it
but it was there and it was something
that people could try using and protect
themselves against having their
ciphertext intercepted and uh then
broken by Future quantum computers and
at some point the United States
government realized that they do not
like having people using post Quantum
cryptography and so they put out some
announcements first of all the U.S
National Institute of Standards and
Technology said don't let people start
to buy and Implement non-standard
unknown potentially unsecured post
Quantum cryptography because we haven't
agreed on standards yet now this is very
interesting if you remember what Tommy
was saying at the beginning we want to
have post Quantum cryptography rolled
out now because there are people who
have data which is being exposed now and
this is something where okay we don't
necessarily have some
well small fast systems that we're
confident in but we have some big slow
systems that have been around for a very
long time that we are sure are going to
hold up and those are systems where
that's the best protection we can get
for users who need security now they
need it against future quantum computers
and so let's roll those things up and at
the same time Tanya was saying we should
work our standards for things where you
know get confidence in some vascular
system so that we can get more people
using these things there's no conflict
between having things rolled out now and
having standards but nist was saying do
not use post Quantum cryptography now
which is very very strict NSA United
States National Security Agency said the
same thing NSS customers are reminded
that NSA does not recommend and you're
not allowed to use non-standard
cryptographic algorithms the U.S
Department of Homeland Security said do
not use
post Quantum cryptography industry
products until standardization
implementation and testing are completed
by nist very very strange
at the same time NSA was also saying
that well if you do use post Quantum
cryptography then do not combine it with
elliptic curve cryptography they said
they do not expect to approve
combinations of post-quantum and ECC
crypto systems which is very different
from what Google will say it's a lot
like what nist was doing but why was
nist saying this well interesting
question what does it mean for for NSA
not to approve this well NSA is
controlling U.S government cryptographic
purchasing and if they say they're not
going to approve something then well
that means that vendors companies
selling to the US government are not
able to sell that to the US government
because NSA says no and that really
changes how companies think about where
they're going to put their resources
into cryptographic development so
doesn't mean there's been a change of
mind from me giving a talk in 2016 and
Google doing 2016 experiments or is it
just a difference between Defenders and
attackers
so let's see what I was saying already
in the user report that I had on my
previous slides we were having a good
paragraph about hybrids but also
sometimes some standardization bodies so
NC is the U.S banking standards and they
have a working group I had a document on
post-con photography and they are very
much the opposite of what this has been
saying and they say well it is required
to use both classical photography and
post photography method for both
security and acceptance so in their 21
October release they were going exactly
the opposite way the same way as I'm
going the same as Anita is good and also
the French so almost the same but it's
uh
security so this is on scene they have
also a statement from early 20 from late
2021 early 2000 to 2022 where they are
saying that it's actually the other way
around they will not endorse any drop in
replacement so they will only accept
fibers
and it's also interesting that they are
saying well that postponed cartography
is immature
and I think that is correct for most of
the systems that were stored in this
competition at that point there was some
which are aged well that also
recommended earlier but most of the
systems were rather new and somewhat
understood it
um I also very much like the end of the
recommendation where they're saying this
immaturity should not serve it's an
argument for postponing the first
deployment so they were saying it's very
important to go get going but really
make sure to combine them use a pre
Quantum system with a postpartum system
all right so
all of these uh
systems were available
um all the the conservative systems were
available in 2015 2016 that's something
people could use but in 2021 end of 2021
people were usually still not using them
well occasional bits of deployment like
you were hearing about open SSH but it's
really most people were not using these
things and then even more arguing about
hybrids and then well nist was delaying
things more and more the most amazing
series of delays was from the end of
2021 this said we're going to select the
first post Quantum standards for chems
that means encryption mechanisms there's
certain technical distinctions but
basically that's public key encryption
we will select our first post Quantum
standards for chems and signatures
around the end of December or sometime
early January well in February they said
we hope to be able to announce not later
than the end of March
meanwhile open SSH said you know we're
just going to turn on post Quantum
crypto on the server by default you
still have to ask for it like the client
administrator has to ask for it or as a
user typing SSH you can ask for it but
at least it's enabled by default on the
server starting with open SSH 8.9 and
meanwhile back at this they said well
we're not ready to make the announcement
in March but we still expect to make it
very soon
well in April 2016 9.0 turned on post
Quantum crypto on the client by default
what happened on the 127th day of March
in 2022 this year Well nist finally kind
of late March late very late March uh
nist finally announced the winners so
they said they have selected four
algorithms to standardize kyber
encryption based on structured lattices
by lithium signatures based on lattices
Falcon signatures based on lattices
Sphinx plus signatures based on
hash functions
well okay so one thing is different
um but three Lada systems for encryption
and signatures and then one signature
scheme which you might recognize that
space again that is the type of design
going back to the late 1970s and having
security just based on the security of
hash function and well along with these
systems that nist said they're going to
standardize they said well they're
they're continuing to study four more
systems so out of the 15 that they had
there are four that they picked to
standardize and four more that they said
they're interested in and they're going
to keep looking at these bike and
classic mclees and hqc based on codes
and psych which I mentioned before as
this psyc e434 experiment between Google
and cloudflare based on isogenes
now there are some interesting features
of the nist report and the nist
selection in July 2022 127th day of
March 2022. um one of the issues
they said in the report that yeah
patents were a factor in their decision
they didn't say patents were critical
they said it was a factor in their
decision and they negotiated with some
third parties to enter into some
agreements to avoid patents okay so if
you need to spends money buying out a
patent then great that means we can use
it I mean it's maybe not the best use of
tax money but at least if the patent
goes away then everybody's free to use
something
except that the same report says the
Agreements are not done yet if the
Agreements are not executed by the end
of 2022 then maybe this will will choose
entry which was another candidate
instead of fiber
so what this tells the patent holders is
nist is not very good at negotiation
meanwhile what it tells industry for
example apple and so on is well maybe
this kyber that we've selected is not
actually going to be free to use so just
keep delaying more which is the main
message that I mean this is what nist
has consistently been saying is
wait forever to roll out post Quantum
photography example of a response from
Cisco well Scott Fleur and Cisco is
until we see what has been signed we
cannot use kyber and if the situation is
like this in the future we're going to
need to do something different
well at least he's looking for
alternative Solutions
now
about these backups so in the market
you're actually really month where we
are waiting for this to announce because
I mean they said late December early
January and then kept delay until late
March there were several articles that
were well reporters interviewing people
from this so for instance nature at an
article where somebody interviewed
Dustin Moody
um the head of this the postponed
project at nist and so he was saying
that they would have some reserves but
they're also standardize in case the
First Choice ends up being broken by the
unexpected attack
so there it sounded like that you'd have
two algorithms for each application so
publicly encryption would have two and
signatures would have to
and similarly even in June there was an
interview whereas they're saying they
don't want to put all X gasket and only
have that to solve with us and well then
that is the space and they have nothing
else which is a little bit strange when
you see what they posted actually a few
days later namely three out of four
being based on lattices and three out of
four being encryption as signatures and
only one encryption person there is no
fault
and I was saying before that crucial the
thing where to get right now signature
well I didn't even talk about the
urgency of signatures encryption is the
thing where today our data goes over the
wire and everything which is weak then
the attack has all our data it doesn't
matter the later on might get a better
encryption system if today's system is
broken
there are four more systems in round
four those are public key encryption
systems so we might get more selection
after round four but that will be
delayed by what another two years till
decision and another two years
um till the standards written so 2024 we
would know what it is and then another
two years for the standard
so something goes very strangely here
and let me come on the stability of of
lattices so I'm then has highlighted the
novelty but let me also talk about the
ability of systems
so what you see in this graph is the uh
so for cryptosystem the asymptotic
security
from 1978 till 2022. we'll be looking
while we're scaling it by the security
actually should be 2022 I'm sorry it
didn't update the number there so by the
current security and the ratio of the
current accounts so if if they attack
asymptotically doesn't improve you see a
nice horizontal line
so is this actually what happened with
lattices well not quite this is actually
the story from at least for code based
system from the 70s which I sort of
already gave away by saying letters is
not New York what you see Miss lettuce
is quite a different shape so let us
start over here
much much higher security compared to
now the ratio is facing infinity and
then come down and come down and down
down again so the last the last decade
that was like 42 higher security level
in 2010 than today
now
if you go into the systems that are
actually standardized on it not always
notice they're even having more
universes these are the basic
lettersections
all right so let us just have
come down and security quite noticeably
so maybe this is what Miss meant when
they wrote in the report that our
understanding of the concrete security
of letters-based crypto systems has
greatly improved over the past several
years
another interesting feature of the
nist's report was what they said the
goal was if you go back to 2016
call for submissions from this then they
said that as I mentioned before the most
important factor in evaluating
sufficients is security and the reason
for that right at the beginning of the
document they say the goal of post
Quantum cryptography is to develop
cryptographic algorithms that would be
secure against Quantum and of course
classical computers I mean we already
have something that the new part is the
quote Department we already have
something which is safe pre-quanton
namely elliptic cryptography so okay if
the goal is to develop something secure
then obviously security is the most
important factor and they say it's the
most important factor and then they also
list a bunch of other things I mentioned
distractions and they said for example
if your security is good and if your
performance is good I mean they were
imagining that everything would be fine
with security instead of a tax attacks
attacks attacks everything losing
security they were thinking they're
going to be fine with security and so
they can ask for extra features security
and performance vegetables stretch goals
yeah extra flexibility and then example
4c1e in the golfer's admissions of
flexibility which is preferable if
you've got everything else is they said
that your system can be incorporated
into existing protocols requiring as few
changes as possible which you can
interpret in various ways about like how
small things are whether they fit into
packets for example
um there's various interpretations but
in any case this was an extra feature
because Mist did not realize that the
main problem was for security Now
um of course it's very important to have
post Quantum crypto rolled out on the
internet
but that doesn't mean that we're leaving
protocols unchanged we have to change
the software to use new crypto and the
exact changes to the software okay if
it's fewer changes that that's that's
better but it it's not an important
thing what's important is security
now if you look at nist's latest report
from July or very late March 2022 then
they say the goal of post Quantum
cryptography this is an exact quote from
the report it read it it's amazing the
goal of post Quantum cryptography is not
security the goal is to develop systems
that can be deployed on the internet in
your current protocols without
significant modifications
okay it's nice to have that if you can
have that but if this is uh I mean if
there's a tension if there's a conflict
between how many protocol changes you
have and security then you have to
prioritize security and that's something
they did in 2016 and they changed that
in 2022.
this is a picture of how nist is
handling their goals for post Quantum
pure doctor
all right well it's been a bit more than
a month since
the Iran Force started so how about the
tax and actually
um yeah there has been a little bit of
interesting stuff happening so remember
that the round four has three code based
and this one isotony based system and on
the 30th of July castigated were
announcing a preliminary version but
they were like well it's kind of
important to get this out so our paper
isn't fully written but we have a script
which breaks all proposed parameters
like on laptop
and then over the next few days Giacomo
Pope was writing a pastor script in Sage
because the first one needed map which
is not free and of course if you can
write it in Sage it's better and then
several other people joined in and it's
gotten faster more people
generalized the attack actually the next
one might be on Martindale had started
this independent office
they were actually describing speed UPS
so um to show you the effects of well
first of all cast implementation and
also the improvements from the Obama we
don't think and so on so the um
this is the column which was secured to
level one
so this is a real submission to the nist
proposal and this is like the highest
proposal for this security levels Those
Were Meant to resist not just current
computers not just well biggest cluster
you can imagine for many years but even
quantum computer and by now the level
one is down to 22 seconds and the
biggest one is down to one hour on job
well so I might be sounding quite
similar to what I was saying earlier
when I now read out that our
understanding of the concrete security
of Psych has greatly improved over the
last days
so
this is an example of a disaster for
psych and in general when something gets
broken it's a disaster for that crypto
system and a disaster for anybody using
the crypto system but the real disaster
is that in 2022 we're still not even
trying to protect user data there's a
few exceptions like openssh but most
applications are not even trying to roll
something out and I mean if something
gets rolled out and it goes wrong then
that's that's bad but maybe we managed
to roll something out which is safe and
we've had some systems which have been
studied since the 1970s and they're not
that expensive we could just use those
even if there's some applications that
can't afford those then well try
something and that's what we've been
completely failing to do so user data
right now is being intercepted by
attackers and as soon as they have
quantum computers they will be breaking
ECC and then under standing what all the
all the confidential user data sets
all right we have two more slides but in
the interest of time maybe I'll just
briefly say that one slide is saying
what you can do now which is you can try
rolling something out I mean make sure
you tpcc but you can attach some
postponed proposal to ECC and then make
sure you do this in a way which is
preserving the security of both there's
more detailed documents that will
explain what exactly you should be doing
here to make sure that you're safe and
that you're encrypting using both
systems and the attacker has to break
both or you're signing using both
systems and then the attacker has to
break both make sure you verify both
signatures and then for choosing systems
well it's safest to choose the systems
that have been around since the 1970s if
you really cannot afford that then well
try rolling out something else and
hopefully it's okay it's it's of course
more dangerous but at least try and then
maybe we managed to protect you today
and then the last slide is just a bunch
of links and we'll have that in the
slides online thank you for your
attention
um so thanks for the um Grace that's
great uh talk um so um I guess um due to
time constraint we probably can have
only one question so
um uh does anyone um from on-site wants
to ask a question
um
if not I guess I'll I'll pick one of the
questions from from online
um so um
so um like previously you have mentioned
about the anasti shifting their goals so
um
So like um
uh do you feel that they should what
else do you think they should do instead
um
so I mean we were hoping that they would
prioritize Security in their choices and
we were also lobbying for saying that
they could standardize some systems soon
where they have confidence and then
continue on those with lower confidence
and instead they've been going for those
which are convenient to roll out but are
not really well started and well then of
course what we're recommending is to use
it with highways what Anisa the French
ANSI the American anti and basically
everybody other than the US government
is recommending this Studios hybrid
schemes and I wish that list would
listen and switch to that
um so in essence um it is not very wise
to kind of just roll out one of the not
not very proven secure
um algorithms
well
if you come before the better ones use a
good combination of ECC and whatever you
can afford
our choice wouldn't necessarily have
been kyber I say that flat out but I
mean it is still better to roll it out
now than to wait for another two years
until this has finally written the
standard so they're still even with
their choices there's better things one
can do than what they're currently out
for
okay um great thanks so
um your slides will be made available as
in you're willing to publish the slides
right
um
so um uh if any of the audience wants to
contact
um uh the speakers
um there's emails on the slides right
um we'll post it and he'll also be on
other systems later today okay cool um
so thanks um I think uh that that's it
for um this this talk and um that's um
thank them again with the round of
applause