2
$\begingroup$

The second question my students have asked me about PQ/Classical Hybrids is about why we think they are good for protecting information with a long security lifetime. If we don't trust current PQ schemes enough today to use them to protect information on their own, why should we have any confidence that they would be sufficient to protect information after quantum computers have been realized? When that happens whatever PQ scheme we used in a hybrid will be the only thing left protecting the information since the classical portion of the hybrid will have been broken. In the long run using a hybrid scheme to protect long lived information today is equivalent to using only a post quantum algorithm in the future when quantum computers are here. What is the rationale for choosing some PQ algorithm today and believing it will protect data in the future?

$\endgroup$
2
$\begingroup$

Trusting the algorithms is not a black and white issue. Given that we cannot unequivocally prove the hardness of the problems underlying basic cryptographic primitives, we have no choice but to assume that they are hard. A vast amount of effort in cryptographic research is spent on minimising these assumptions and analysing their hardness. We already have a long track record with lattice-based cryptography and hard problems in lattices. However, we have a far longer track record with problems like RSA and discrete log/Diffie-Hellman assumptions. As such, we have more "trust" in them. Furthermore, key lengths is tricky, and although certain problems may indeed be very hard, understanding how hard they are is crucial for setting key lengths. (This is why Elliptic curve keys can be 256 bits vs RSA key that have be 2048 bits at the very minimum.) With lattice and other assumptions used for PQC, we have less experience with this.

So, we have no reason whatsoever to believe that lattice-based or other PQ proposals will not be good enough in the long term if quantum computers at scale are ever built. However, we also have less history with these assumptions, and the prudent and conservative approach is to take both (with hybrid encryption). As time goes on, we will learn more and more about the lattice and other assumptions, and will feel more comfortable about using them by themselves.

| improve this answer | |
$\endgroup$
0
$\begingroup$

Actually, we do trust many (but obviously not all) post-quantum cryptosystems more than traditional schemes. We haven't been using them because they fail to meet practical space and time trade-offs.

We start pessimistic with high parameters, then gradually cut down the space by filtering out bad or slow parameter classes until we have reasonable space and time trade-offs for various security levels.

However, if we are wrong and some assumption is proven incorrect, we want to be sure our protocols are no less secure than the traditional systems we know better. The hybrid solutions are no weaker than their strongest component.

What is the rationale for choosing some PQ algorithm today and believing it will protect data in the future?

Exactly the same rationale for choosing any algorithm today and believing it will do its task despite future developments. Alternatively, don't choose. Use them all ! .. and then really hope at least one is actually good. Or ignore PQ schemes and use preshared keys. We should be using preshared keys more often. If I have established secure channels with my peers and wish to introduce them, I can give them preshared keys in addition to public keys.

| improve this answer | |
$\endgroup$
  • $\begingroup$ Depending on the application, a hybrid solution may be more secure than its strongest part. For instance, the concatenation of an MD5 and SHA1 hash of a file is much harder to collide than either isolated function. $\endgroup$ – cypherfox Mar 9 at 7:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.