Can the combination of X25519 ECDH and NTRU in OpenSSH 9.X defend me against quantum attacks?
Why is it believed that this combination is secure?
$\begingroup$
$\endgroup$
1
-
4$\begingroup$ See also: quantumcomputing.stackexchange.com/q/25987/18991 $\endgroup$– Mikko RantalainenCommented Nov 12, 2022 at 11:07
Add a comment
|
1 Answer
$\begingroup$
$\endgroup$
2
Can the combination of X25519 ECDH and NTRU in OpenSSH 9.X defend me against quantum attacks?
Actually, that version of OpenSSH uses NTRU Prime, rather than NTRU.
However, that does not change the answer: it is believed that the combination is resistant to attackers with Quantum Computers attempting a 'store-and-decrypt-later' attack.
Why is it believed that this combination is secure?
We believe it is secure because we believe that NTRU Prime is secure against a Quantum Adversary, and the secret keys that protect the traffic depend on the NTRU Prime shared secret. Without those secret keys, the attacker would need to attack the symmetric ciphers directly, which we believe is also too hard.
Now, I did put in weasel words about 'store-and-decrypt later' attacks; another possible attack (if the attacker has a Quantum Computer at the time of the exchange) is to break the authentication piece of SSH. I don't know if that is similarly protected (it might be; I don't know); if it is isn't, then this is also a potential avenue. Of course, this attack can only be used to attacks going forward, and previous sessions are unaffected.
-
3$\begingroup$ Could you explain X25519 ECDH and NTRU Prime a little more? This is a newest question here about this.. $\endgroup$– kelalakaCommented Apr 18, 2022 at 21:54
-
1$\begingroup$ @poncho | Can you write some words, what do you mean about "the authentication piece of SSH"? $\endgroup$– Z0OMCommented Apr 19, 2022 at 17:34