I know about VIC and Solitare but as I understand they are not quantum resistant ciphers. Is there any quantum resistant pen-and-paper or mind cipher?
2
-
3$\begingroup$ Why would Solitaire not be quantum resistant? $\endgroup$– CodesInChaosJul 16, 2017 at 19:59
-
$\begingroup$ @CodesInChaos From that comment (crypto.stackexchange.com/a/865/16486 ) I found out that Solitare has many similarities with RC4. And by reading Wikipedia article I found out that it has many weaknesses even without quantum computers. $\endgroup$– vasili111Jul 17, 2017 at 7:07
Add a comment
|
2 Answers
$\begingroup$
$\endgroup$
1
If used properly, a One Time Pad is the only quantum-resistant pen-and-paper option I know of. Keys would have to be randomly generated, securely transmitted, never used more than once, and at least as long as the message.
While meeting all those requirements is difficult, manual OTP systems such as the DIANA system used by US Special Forces in Vietnam can be very quickly used by hand with practice.
-
2$\begingroup$ This is a great point and so obvious I can't believe I missed it! +1 $\endgroup$ Jul 16, 2017 at 20:11
$\begingroup$
$\endgroup$
2
You are not likely to find such a construction. One problem you will run in to is that of size: In order to be secure against brute force search with Grover's algorithm, you will need to use at least 200 bits of secret material. And that assumes you are content with a security level of $2^{100}$.
This is equal to 25 random bytes or a 60 digit long decimal number that you will have to remember and do mental math with. In addition, you will also need to keep your message and any intermediate state in mind as well.
Assuming that your ciphertexts will be on paper or some other physical medium (because you wouldn't go through the trouble to compute AES by hand to send the result via e-mail), a quantum computer cracking your ciphertext is probably the least realistic of your concerns - if your adversary already has your ciphertext, they probably already have the messages sender and/or recipient as well, which means they have far less expensive ways of obtaining the message.
-
2$\begingroup$ ChaCha20 can be done by hand, and the algorithm is simple enough that it can be memorized. It gets very tedious, and uses a lot of paper, but can be a fun exercise if you're in to this sort of thing. Expect to take most of a day. I haven't tried any MAC or AEAD constructions by hand. $\endgroup$ Jul 16, 2017 at 20:18
-
1$\begingroup$ With regard to key size, a 20-word diceware passpoem wouldn't be that hard to memorize. I've memorized several 10-word ones. At 13.9 bits of entropy per word that gets you over 256 bits of entropy (19 words would be enough). The difficulty is the key derivation function, I'm not sure which cryptographic hash function with 256-bit output size would be easiest to memorize. $\endgroup$ Jul 16, 2017 at 21:02