Subject: Re: [CFRG] NSA vs. hybrid

From: "Blumenthal, Uri - 0553 - MITLL" <[email-masked]>
Date: Sun, 5 Dec 2021 01:44:53 +0000

> IMO the one thing we *do know* is that PQ crypto libs
> will have implementation bugs,

And non-PQ crypto libs are not and/or will not? 
Like, for example, very mature and reasonably-well maintained NSS?

> which means we *will* have to contend with case 6, at least transitively.

Since I consider the premise to be broken, I reject the conclusion.

> Which, given your language, gives us a 100% chance that hybrid helps :)

Disagree - see above. I personally evaluate its likelihood as negligible - which is why I hold my opinion.

>    > I'm asking why the current Classic algorithms have not been
>    > paired using the same approach - as they have been around
>    > from 10 to 25 years longer than, e.g., NTRU.
>
> Let's say this reasoning is correct;

Please feel free to show the flaw in this reasoning.

> let's say that in retrospect we should have layered new ECC implementations
> with RSA for some transition period,

My point is: we "should NOT have layered..." then, and we did not - as evidenced by pretty much all of the current IETF and proprietary (that I'm aware of) protocols. 
(One exception I know of: TrueCrypt (now diseased) and VeraCrypt offer cascade encryption as an option.)

People who designed IPsec and TLS (presumably as smart and educated as we are) understood the concept of combining different algorithms as well as we do (it's hard not to, given its age). 

Might find this interesting to read (by Matthew Green, JHU): 
https://blog.cryptographyengineering.com/2012/02/02/multiple-encryption/ 

The common sense prevailed back then, and IMHO it would be better if it prevails now.

> isn't that more reason to develop hybrid mechanisms now so that they
> are available the next time we need to transition from an old
> battle-tested thing to a newer thing?

In one word - no. 

Besides, there's no such thing as "battle-tested" in crypto - what's been strong for 20-40-60 years may fall in one day, or it may not. My personal bet is that the math would likely survive attacks, the implementations - who knows. But that applies to Classic and PQ equally - e.g., if you extract somebody's private key via CPU cache, it won't matter whether it's a PQ or Classic key...

---

From: Dan Brown <[email-masked]>
Date: Mon, 6 Dec 2021 15:19:27 +0000

> -----Original Message-----
> From: Blumenthal, Uri - 0553 - MITLL
> Sent: Saturday, December 4, 2021 8:45 PM
> ...
> My point is: we "should NOT have layered..." then, and we did not - as
> evidenced by pretty much all of the current IETF and proprietary (that I'm
> aware of) protocols.
> ...
> People who designed IPsec and TLS (presumably as smart and educated as
> we are) understood the concept of combining different algorithms as well as
> we do (it's hard not to, given its age).
> ...

Not offering hybrid, say NTRU & ECC, in the past put us in this pickle now of 
the quantum computer attack risk.
Especially, all the forward secrecy obtained in the past from (EC)DHE is now 
in jeopardy (even for bug-free implementations).
Arguably, it was a smaller bug than others (using http not https, and 
non-forward-secure key exchange (RSA)).
Certainly, there are applications where the gains from hybrid are outweighed 
by the cost, but also applications where hybrid is worthwhile.
Hybrid ought to be option, or IETF WGs should use a cost-benefit analysis per 
application, the CFRG could help there.
(Generally, let's learn from our mistakes. Besides, aren't some users 
naturally inclined to expect the Internet to maximally secure their data? ;)

----------------------------------------------------------------------
This transmission (including any attachments) may contain confidential information, privileged material (including material protected by the solicitor-client or other applicable privileges), or constitute non-public information. Any use of this information by anyone other than the intended recipient is prohibited. If you have received this transmission in error, please immediately reply to the sender and delete this information from your system. Use, dissemination, distribution, or reproduction of this transmission by unintended recipients is not authorized and may be unlawful.

---

From: "Blumenthal, Uri - 0553 - MITLL" <[email-masked]>
Date: Tue, 7 Dec 2021 15:44:12 +0000

>    the quantum computer attack risk.

I disagree. 

Back then, similarly to here-and-now, cryptographers could not know whether there'd be a breakthrough in discrete log, or in factoring, or in both (or in SVP). So, a prudent (from your point of view) thing would've been to combine (all of them). Instead, they (correctly, IMHO) decided that it isn't worth doing - the low likelihood of such a breakthrough did not justify that. 

NTRU now has been studied for as long as RSA then, and other Lattice-based algorithms - for as long as ECC then.

I concede that there was almost no FUD back then, compared to now. 

>    application, the CFRG could help there.

How do you evaluate the benefit? "If algorithm X gets broken, with a probability I've no idea of..."?

>    (Generally, let's learn from our mistakes.

Given that we had no problem caused by "not combining algorithms" so far, I say the mistake is what we're trying to do now.

>    Besides, aren't some users 

:-) Cuique suum.