Subject: [Cfrg] A terminology issue with "post-quantum cryptography"

From: Paul Hoffman <[email-masked]>
Date: Wed, 16 Aug 2017 17:55:50 +0000

Greetings. I was talking with a colleague this morning about draft-hoffman-c2pq and trying to describe quantum computing for cryptanalysis, and why quantum cryptography is not part of it. Their response should give us pause about our terminology: "So post-quantum cryptography is what we get after quantum cryptography is fully developed?".

I'm not offering a solution here, but that question is quite understandable and terrible at the same time.

--Paul Hoffman

---

From: Kyle Rose <[email-masked]>
Date: Wed, 16 Aug 2017 14:00:28 -0400

> I'm not offering a solution here, but that question is quite understandable and terrible at the same time.

I wonder if "quantum resistant cryptography" is a better phrasing.
(The fact that there are some strong lower-bound results makes it more
than just "resistant", but it at least eliminates the other class of
interpretations.)

"PQC" may be here to stay, however: it's probably too widespread to
easily change.

Kyle

---

From: Ira McDonald <[email-masked]>
Date: Wed, 16 Aug 2017 17:37:16 -0400

Hi,

The "quantum resistant crypto" is a lot more accurate term.

The term "quantum safe crypto" is heavily used in some SDOs (and
of course the "safe" part is inaccurate and should be "resistant").

Cheers,
- Ira

Ira McDonald (Musician / Software Architect)
Co-Chair - TCG Trusted Mobility Solutions WG
Chair - Linux Foundation Open Printing WG
Secretary - IEEE-ISTO Printer Working Group
Co-Chair - IEEE-ISTO PWG Internet Printing Protocol WG
IETF Designated Expert - IPP & Printer MIB
Blue Roof Music / High North Inc
http://sites.google.com/site/blueroofmusic
http://sites.google.com/site/highnorthinc
mailto: [email-masked]
Jan-April: 579 Park Place  Saline, MI  48176  734-944-0094
May-Dec: PO Box 221  Grand Marais, MI 49839  906-494-2434

On Wed, Aug 16, 2017 at 2:00 PM, Kyle Rose <[email-masked]> wrote:

> > Greetings. I was talking with a colleague this morning about
> draft-hoffman-c2pq and trying to describe quantum computing for
> cryptanalysis, and why quantum cryptography is not part of it. Their
> response should give us pause about our terminology: "So post-quantum
> cryptography is what we get after quantum cryptography is fully developed?".
> >
> > I'm not offering a solution here, but that question is quite
> understandable and terrible at the same time.
>
> _______________________________________________
> Cfrg mailing list
> [email-masked]
> https://www.irtf.org/mailman/listinfo/cfrg
>

---

From: "David McGrew (mcgrew)" <[email-masked]>
Date: Wed, 16 Aug 2017 23:24:46 +0000

Hi Paul,

>Greetings. I was talking with a colleague this morning about draft-hoffman-c2pq and trying to describe quantum computing for cryptanalysis, and why quantum cryptography is not part of it. Their resp…

The current terminology is fine.   We should just be doing a better job of describing why quantum cryptography is not a viable cybersecurity solution.  

David

---

From: Jon Hudson <[email-masked]>
Date: Wed, 16 Aug 2017 21:34:46 -0700

> On Aug 16, 2017, at 2:37 PM, Ira McDonald <[email-masked]> wrote:
> 
> Hi,
> 

Completely agree. "Quantum resistant crypto" is more accurate & descriptive.
 
> of course the "safe" part is inaccurate and should be "resistant").

Anyone using quantum safe, quantum proof or any other definite and/or finite terms will regret doing so.

This is just the beginning.

---

From: "D. J. Bernstein" <[email-masked]>
Date: 17 Aug 2017 12:43:13 -0000

FIPS 186-4 has the sensible title "Digital signature standard", not
"Safe digital signature standard" or "Attack-resistant digital signature
standard". AES isn't the "Safe Advanced Encryption Standard". SHA-1 is
an outlier in terminology, and so now we get to say ridiculous-sounding
things like "Secure Hash Algorithm 1 is not secure".

One of the top hits for "quantum-safe cryptography" is referring to ID
Quantique's QKD products as "provably secure quantum-safe" cryptography.
But research by Makarov et al. has convincingly shown that these
products are breakable at low cost. Do we say "Makarov has broken
quantum-safe cryptography"?

> finite terms will regret doing so.

"Quantum-resistant" is similarly unusable for serious discussions: it's
slightly more vague than "quantum-safe" but shares the basic mistake of
stating a highly questionable _conclusion_.

"Post-quantum" is different. It's focusing on the right _metric_, namely
what security levels we'll have after the apocalyptic moment when the
attackers acquire large quantum computers. Post-quantum attacks are more
powerful than pre-quantum attacks. Algorithms often have post-quantum
security levels far below their apparent pre-quantum security levels.

[Bias alert: I introduced the phrase "post-quantum" in 2003.]

David McGrew (mcgrew) writes:
> The current terminology is fine.   We should just be doing a better
> job of describing why quantum cryptography is not a viable
> cybersecurity solution.

Here's my latest effort: https://blog.cr.yp.to/20160516-quantum.html

Paul Hoffman writes:
> I was talking with a colleague this morning about
> cryptanalysis, and why quantum cryptography is not part of it.
> Their response should give us pause about our terminology: "So
> post-quantum cryptography is what we get after quantum cryptography is
> fully developed?".

What's the dispute here supposed to be?

Quantum cryptography was discussed in the early 1970s; published and
named in the early 1980s; implemented in the late 1980s; brought to
market in the early 2000s.

The concept of post-quantum cryptography would have been awfully
difficult to articulate before Shor's algorithm and Grover's algorithm
were published in the mid-1990s. Of course there was already security
analysis of, e.g., McEliece's cryptosystem, but nobody was separating
post-quantum security levels from pre-quantum security levels.

---Dan

---

From: [email-masked]
Date: Thu, 17 Aug 2017 08:59:04 -0400

Hi everyone,

"Post Quantum Cryptography" is a well established term in the  
cryptographic community now, so I think it is best to keep as is. I  
think a good rational to explain the term to others would be to say  
that it is the crypto that will still be safe after (full scale)  
quantum computers become available.

Vladimir

Quoting "David McGrew (mcgrew)" <[email-masked]>:

> Hi Paul,
>
>
> On 8/16/17, 1:55 PM, "Cfrg on behalf of Paul Hoffman"  
> <[email-masked] on behalf of [email-masked]> wrote:
>
>> post-quantum cryptography is what we get after quantum cryptography  
>> is fully developed?".
>

---

From: "Dearlove, Christopher (UK)" <[email-masked]>
Date: Fri, 18 Aug 2017 11:36:02 +0000

Kyle Rose
> I wonder if "quantum resistant cryptography" is a better phrasing.

Technically, I think it definitely is. Unfortunately when I last (a few month ago) tried the crude "how many hits in Google" test, Post-Quantum Cryptography won hands down.

(There's also a significant usage of the phrase Quantum Safe cryptography out there.)

********************************************************************
This email and any attachments are confidential to the intended
recipient and may also be privileged. If you are not the intended
recipient please delete it from your system and notify the sender.
You should not copy it or use it for any purpose nor disclose or
distribute its contents to any other person.
********************************************************************

---

From: "Dearlove, Christopher (UK)" <[email-masked]>
Date: Fri, 18 Aug 2017 11:41:51 +0000

Responding to myself, I see Dan Bernstein's argument in favour of post-quantum as also technically better. It's a good point. It does however run into the problem already noted that post-quantum isn't after quantum, and that you can do PQC now, before there are any (realistic sized) quantum computers, and that can be confusing too, so nothing is perfect.

-- 
Christopher Dearlove
Senior Principal Engineer
BAE Systems Applied Intelligence Laboratories
__________________________________________________________________________

T:  +44 3300 467500  |  E: [email-masked]

BAE Systems Applied Intelligence, Chelmsford Technology Park, Great Baddow, Chelmsford, Essex CM2 8HN.
www.baesystems.com/ai
BAE Systems Applied Intelligence Limited
Registered in England & Wales No: 01337451
Registered Office: Surrey Research Park, Guildford, Surrey, GU2 7YP

-----Original Message-----
From: Cfrg [mailto:[email-masked]] On Behalf Of Dearlove, Christopher (UK)
Sent: 18 August 2017 12:36
To: Kyle Rose; Paul Hoffman
Cc: [email-masked]
Subject: Re: [Cfrg] A terminology issue with "post-quantum cryptography"

----------------------! WARNING ! ---------------------- This message originates from outside our organisation, either from an external partner or from the internet.
Consider carefully whether you should click on any links, open any attachments or reply.
Follow the 'Report Suspicious Emails' link on IT matters for instructions on reporting suspicious email messages.
--------------------------------------------------------

*** WARNING ***
EXTERNAL EMAIL -- This message originates from outside our organization.

Kyle Rose

********************************************************************
This email and any attachments are confidential to the intended recipient and may also be privileged. If you are not the intended recipient please delete it from your system and notify the sender.
You should not copy it or use it for any purpose nor disclose or distribute its contents to any other person.
********************************************************************

---

From: Dan Brown <[email-masked]>
Date: Fri, 18 Aug 2017 16:02:37 +0000

How about quantum-prudent or quantum-cautious cryptography?
/*
I'm not a PQC researcher, so please feel free to ignore my $0.02.

Finding (brief) terminology for this topic seems difficult, mainly because of the extra conjectures and timing (see below).  But it is only terminology, so it is probably okay just to stick to a tradition, or okay to churn it up, or be imperfect.

There is a need (see below) for distinct terminology for task and the tool.  For example, McEliece (the tool) is (reasonably) conjectured to provide quantum-resistance (the task).  Postquantum crypto could a help as a noun for a generic tool (conjectured to be quantum-resistant).

There seems some value in specificity.  For example, ECC is rarely called post-factoring or sieving-resistant ,etc. (to address the non-zero risk of a faster classical-computer factoring or sieving algorithm), partly because that's not specific to ECC.

There is a need for quantum-resistance because of a non-negligible risk of quantum computer. But it is bad if pushes towards this need seem to imply dropping ECC, because that would trade one risk for another.  Terms like postquantum and quantum-resistant do little to remind us that a quantum computer is only conjectural, so these terms must often be accompanied by further clarifications and explanations (e.g., don't drop ECC).

Supplementing ECC or RSA with some kind of conjecturally quantum-resistant proposal pre-emptively is often justified (the cost is worth addressing the risk), but calling this "postquantum" does not go far enough to encourage this practice (because post suggests waiting) or clarify the timing (recall how NIST called forward secrecy backtracking resistance.)

Shor's algorithm makes it a certainty that a large-enough quantum computer would break RSA and ECC. Confusing that certainty with various PQC proposals being quantum-resistant is inaccurate.  In this regard, the leading terms postquantum and quantum-resistant overstate the case (as do quantum-prudent and quantum-cautious).  To this end, I tried to think up a short name more specific to Shor's algorithm, but only came up with silly jokes, such as shor-ward-secure, or vague techno terms like no-hidden-group.  (This strategy also completely ignores the symmetric key case and Grover's algorithm, but that situation is simpler.)
*/

---

From: Andre Brisson <[email-masked]>
Date: Fri, 18 Aug 2017 16:42:59 +0000

The assertion highlighted in yellow is interesting. The IEEE is publishing papers concerning the factoring topic and the utility  was demonstrated at a ATC IEEE Trusted Computing workshop in Silicon Valley August 4. It has been around a while. It is being demonstrated at the Hague during another conference particularly to NATO and Europol in October.

Before knee jerk comments it is recommended that you build and test it. Scientific method and informed comments are always good. It is simple enough to build. It is also simple to request a copy of the utility if you can be permitted under regulatory regime.

AB

http://www.wnlabs.com/news/ECC-is-easier-to-break.php

http://www.wnlabs.com/pdf/IEEE-ATC-R-CyberTrust-27.pdf This informs engineers or beginner computer scientists how to build utility.

http://www.wnlabs.com/news/IEEE_copyright_WN_papers.php

-----Original Message-----
From: Cfrg [mailto:[email-masked]] On Behalf Of Dan Brown
Sent: Friday, August 18, 2017 9:03 AM
To: D. J. Bernstein; [email-masked]
Subject: Re: [Cfrg] A terminology issue with "post-quantum cryptography"

/*

There is a need for quantum-resistance because of a non-negligible risk of quantum computer. But it is bad if pushes towards this need seem to imply dropping ECC, because that would trade one risk for another.  Terms like postquantum and quantum-resistant do little to remind us that a quantum computer is only conjectural (questionable), so these terms must often be accompanied by further clarifications and explanations (e.g., don't drop ECC).

Shor's algorithm makes it a certainty that a large-enough quantum computer would break RSA and ECC. Confusing that certainty with various PQC proposals being quantum-resistant is inaccurate.  In this regard, the leading terms postquantum and quantum-resistant overstate the case (as do quantum-prudent and quantum-cautious).  To this end, I tried to think up a short name more specific to Shor's algorithm, but only came up with silly jokes, such as shor-ward-secure, or vague techno terms like no-hidden-group.  (This strategy also completely ignores the symmetric key case and Grover's algorithm, but that situation is simpler.) */

Cfrg mailing list

[email-masked]<mailto:[email-masked]>