2
$\begingroup$

At this point, should we consider it irresponsible to design new systems that assume hardness of problems already known vulnerable to quantum computers, such as factoring of large numbers or discrete logarithms? Likewise, do we have a moral obligation when answering questions about cryptosystems based on these, to ensure readers are aware of the coming insecurity?

$\endgroup$
5
  • $\begingroup$ Is there a good reason this question should not be closed as "primarily opinion-based"? $\endgroup$
    – mikeazo
    Dec 22 '17 at 14:58
  • $\begingroup$ What do you have in mind when you say "design new systems"? Are you talking applications (e.g., bitcoin), protocols (e.g., signal protocol), or cryptographic primitives? $\endgroup$
    – mikeazo
    Dec 22 '17 at 15:03
  • $\begingroup$ FWIW, based on the guidance here, I'd recommend not closing this question as opinion based. $\endgroup$
    – mikeazo
    Dec 22 '17 at 15:05
  • $\begingroup$ @mikeazo I trather interpreted as a "what do you think?" kind of question. Yet, I agree to keeping it open $\endgroup$
    – e-sushi
    Dec 22 '17 at 21:18
  • $\begingroup$ @mikeazo - yes, all of the above. Having attended a recent D-Wave user conference where people presented work on current generation quantum annealing machines and work was presented on their next quantum annealer, I'm getting nervous. When I look at discussion here and new work from otherwise well-informed individuals, I sense a disconnect. It would be inappropriately off-topic to divert a crypto forum into discussions about progress on quantum computing, a very complex and arcane topic, and yet it matters. D-Waves are not general-purpose annealers, but, they are at 2,000 qubits and counting $\endgroup$ Dec 23 '17 at 23:31
4
$\begingroup$

Should we consider it irresponsible to design new systems that assume hardness of problems already known vulnerable to quantum computers, such as factoring of large numbers or discrete logarithms?

Some would answer that it is irresponsible to design new systems at all, regardless of the threat of quantum computing. It's hard to prove something is secure even in a classical computing setting, as it requires valuable time from highly skilled people.

Others might argue that Quantum Computing might never take off and become a real thing, and so designing post-quantum algorithms is a waste of time.

We usually (arguably have to) assume the worst-case scenario when designing algorithms, and the worst-case scenario in this day and age implies a quantum computer. You could design new cryptosystems based off of problems that are known to be vulnerable to quantum algorithms and hope that quantum computers never become relevant.

If you are disinclined to include "hope" in the justification for your design, then you need to avoid problems that are already known to be broken. This means using hard problems other then the discrete logarithm/factorization.

Likewise, do we have a moral obligation when answering questions about cryptosystems based on these, to ensure readers are aware of the coming insecurity?

It depends on your specific audience.

If it's just someone who is asking a question on crypto.se about discrete logarithms in general, then it may (or may not) be off-topic to bring up quantum computing.

Anyone who is capable of designing their own public key algorithms is probably already aware of the threat of quantum computers and hopefully does not need to be told.

Someone who is designing a new protocol should be informed that the standard go-to primitives may not provide long term security against quantum computers. Again, they may already be aware.

If your audience is someone who is instantiating a specific, already defined protocol that uses DH or RSA, then telling them that DH or RSA is broken against quantum computing is possibly not helpful or relevant - it's not up to them to make such design changes. Although, such information may cause them to select a new protocol to implement.

I would say that if it the information is relevant and they are unlikely to know it already, it certainly should be mentioned.

$\endgroup$
1
  • $\begingroup$ D-Wave machines are at 2,000 qubits and counting. Granted, they are not (yet) general purpose quantum annealers, but general purpose quantum annealers are already known to be equivalent to within polynomial time of quantum gate machines. So I'm thinking this question might not just be academic, the way technology is progressing on the quantum side. $\endgroup$ Dec 24 '17 at 3:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.