Tony Arcieri makes an interesting point in his Imperfect Forward Secrecy article which basically boils down to:
- large entities such as NSA are storing encrypted internet traffic, also what's to stop smaller entities such as proxy owners from doing the same
- that data should be considered as good as clear text when quantum computers of sufficient strength hit the shelves and as that date grows near more people will start logging encrypted traffic
- quantum computers are getting stronger with a good pace (82-qbit computer last year, 512-qbit computer this year) and a not-unreasonable estimate is that quantum computers will hit the shelves in 10-20 years
- when this happens much (all?) stored encrypted data will be compromised
Problem existed before of course due to growing strength of computing technology and many protocols where discovered to be flawed by design, but the promise of a computer which breaks modern cryptography and knowledge of existence of giant datacenters which store data encrypted by obsolete standards make it worse.
It doesn't seem acceptable any more to just protect against today's cryptographic threats and know that all of the data you thought secure will be freely available to a patient individual in a not distant future (think of credit card numbers for example, password patterns that many people use etc)
So the question is, what kind of encryption/hashing one can use today to protect against long-term data storage?
The "quantum cryptocalypse" simply exasparates a previously existing issue as more parties are likely to store encrypted data and wait for a good cryptoanalytical tool.
Problem lies in the general focus on making data secure "now" which is fine unless there's a sufficient number of entities storing encrypted data to break it later.
Quantum cryptocalipse, real or not, will make a lot of people store encrypted traffic on tapes. Idea behind this question is to find a list of algorithms which are "future proof" to the best of our knowledge and such algorithms should probably be quantum-proof too
OK, so what's the bottom line? Is there an asymmetric cryptography protocol that is not compromised by Shore's algorithm? Are there alternatives to using OTP for session key exchange?