What is "quantum safe"? - Page 1
Forum section: electronics / general

author: peter-h
author_rank: Super Contributor
timestamp: February 11, 2025, 11:18:48 pm
content: This is the latest thing in crypto... From the latest MbedTLS mailing:Is it just huge RSA keys, etc?The only defence against a fast computer has always been longer keys. It can't be different algorithms, otherwise why not use them right now? Well, except for the one time pad, but you have a key management issue there

author: ataradov
author_rank: Super Contributor
timestamp: February 12, 2025, 12:49:14 am
content: No, there is a whole new set of algorithms that have nothing to do with currently used algorithms.https://www.nist.gov/news-events/news/2022/07/nist-announces-first-four-quantum-resistant-cryptographic-algorithmsYou can't just use them 100% because they are still being tested. There were a few that passed initial rounds of testing and failed almost at the stage of approval. The ones that remain seem to be pretty solid.Some implementations use both at the same time. Use classical stuff and then quantum resistant on top of it. If quantum breaks, no big deal, classical stuff will provide protection.

author: Bud
author_rank: Super Contributor
timestamp: February 12, 2025, 01:03:48 am
content: Do not bother, there will be no quantum computers capable of breaking existing public key scheme encryption for the next 15 years at least.Edit: answering the question, quantum-safe means the algorithm is resistant to attacks using quantum computers, when they become viable (nobody knows when).

author: helius
author_rank: Super Contributor
timestamp: February 12, 2025, 01:08:54 am
content: Cryptologic algorithms that rely on the hardness of factoring or discrete logarithms have never been proven to be secure, because the hardness of these types of math problems is still unproven. It is completely possible that anon-quantumapproach to factorization could break RSA. But a quantum algorithm for solving those problems in linear time was already published by Shor in 1994, which is exponentially faster than the best known classical algorithms based on the General Number Field Sieve, which have exponential complexity.As to the timeframe when quantum computers that can actually apply the Shor algorithm might exist, you need to remember that some secrets need protection for a long time. If it's likely that a cryptosystem might fail 30 years from now, you should stop using it right now if your secrets are that important.

author: Bud
author_rank: Super Contributor
timestamp: February 12, 2025, 01:29:32 am
content: Just use symmetric AES 256, it is quantum safe.For asymmetric key wrapping or signature, the new FIPS 203, 204 and 205 are certified as quantum safe.

author: peter-h
author_rank: Super Contributor
timestamp: February 12, 2025, 11:40:13 am
content: QuoteSurely very few algorithms are provably secure. But maybe the issue is that there is a fear that quantum computers will be able to do factorisation rapidly, whichisdefinitely a way to crack RSA (and others).

author: Siwastaja
author_rank: Super Contributor
timestamp: February 12, 2025, 12:19:12 pm
content: Quote from: Bud on February 12, 2025, 01:03:48 amThis brings us to the key deciding factor:Is it important to keep recorded communications safe, and for how long?This always isn't an issue at all. For example for our "smart heating controller" box, the threat factors are gaining unauthorized control, and thusauthenticationof the participants, and inability to alter the data, or record it and play it back, are the primary goals. For us it would not matter if someone recorded the data and were able to break it after 15.00001 years with a quantum computer, only to see how much power someone consumed 15 years ago and if their electric boiler relay was on.Then again, someone else could be encrypting state secrets. Maybe names of agents whose life becomes threatened if the information leaks. Different outcome - "quantum safe" is needed already today.

author: golden_labels
author_rank: Super Contributor
timestamp: February 12, 2025, 12:19:33 pm
content: Going post by post.Post-quantum cryptography isn’t a “latest thing.” The problem is known for 30 years. The first viable algorithm was presented around that time too. In the past decade existing solutions reached sufficient maturity and people also realized it may be the right time to deploy them. Recent years see this trend surfacing. But it’s just the tip of a decades-deep iceberg.For the entire thread it’s important to note that RSA is an ancient technology. Now we’re talking aboutECC. It allows much better key space usage,(1)and offers different performance characteristics. But it is also vulnerable to quantum computing attacks and, similar to integer factorization, there is no proof of non-existence of a classical attacks.It’s not a matter of longer keys. In both RSA and ECC the underlying problems are vulnerable. If big enough quantum computers become viable, these cryptography solutions will get their mathematical foundations shattered.One of the reasons post-quantum algorithms were not deployed so far and their uptake is slow, is the need to ensure implementations are not considerably more expensive than ECC (or RSA). Time is also needed to recognize potential side-channel attacks. It doesn’t matter a quantum algorithm can’t break lattice-based cryptography in 2040, if in 2024 a script-kiddie armed with a laptop can send 10 GB of data to recover server’s key by observing timings.I don’t understand the dismissive tone of “don’t bother.” A 15 years horizon is not an optimistic vision. Not sure about mentioning symmetric encryption (AES-256) either. It plays no role here, as the topic is only about the asymmetric cryptography.The mention of proofs above was not about the encryption having a proof, but the underlying mathematical problem. We may have an algorithm, whose strength is based on a proven claim. Both RSA and ECC are based on the claim, that integer factorization and discrete logarithms are impossible to solve in polynomial time using classical algorithms. But we only believe this to be true: neither was ever proven. This is separate from any potential weakness affecting one of multiple features a cryptographic algorithm needs to offer. However, there are some hard truths basedin physics.For example 128-bit keys(2)can’t be brute-forced using any foreseeable technology. For 256-bit keys that becomes unconditional. There are also logical impossibilities. No encryption, even Caesar’s cipher(!), can fail its confidentiality promise without some knowledge about the plaintext.(1)Higher entropy per key’s bit. RSA keys are represented as numbers. Only some of those numbers are suitable to be used for cryptography, leaving large areas of the space unused. ECC key space is denser, giving the same results for much shorter keys.(2)Actual keys’ entropy, not the number of bits used to store the key.

author: peter-h
author_rank: Super Contributor
timestamp: February 12, 2025, 12:33:51 pm
content: QuoteThat requirement may lead to hardware-only approaches as it did with e.g. DES whose software implementations mostly had key dependent timings.QuoteIs it? Maybe it is but I was not aware.QuoteI hope nobody is sending agent names in such a wayOr identifying info. Yes I have read much about the Venona project, etc, so people have done it. But one hopes nobody does it today.

author: Bud
author_rank: Super Contributor
timestamp: February 12, 2025, 01:46:42 pm
content: Quote from: golden_labels on February 12, 2025, 12:19:33 pmOP's post came in the context of mbedTLS. I repeat - do not bother for mbedTLS. If someone is using mbedTLS to encrypt state secrets, he has a bigger problem.

author: golden_labels
author_rank: Super Contributor
timestamp: February 12, 2025, 03:06:40 pm
content: Quote from: peter-h on February 12, 2025, 12:33:51 pmHardware implementations are as vulnerable. And much harder to fix.Quote from: peter-h on February 12, 2025, 12:33:51 pmQuantum computing is considered a threat primarily toasymmetric cryptography. Public keys reveal significant amount of information about the private (secret) key. You can almost directly calculate a matching private key from the public key. In fact any IT/CS student should be able to break RSA with a pen and paper. I myself had to do this on an exam. The catch: the amount of work needed grows quickly with key size. So while it’s trivial for small integers, doing so for 4096-bit values is prohibitively expensive.With symmetric ciphers this isn’t the case. There isn’t any such clear relationship, no ready equations to calculate the key from anything, no way to easily verify the result. If either is possible, it’s a vulnerability and it has to be discovered. In that sense quantum computing may lead to some vulnerabilities being exploitable even in symmetric ciphers. But this is very different from asymmetric cryptography, where the way to break a cryptographic primitive is literally given along with its definition.In either case, classic or post-quantum, asymmetric cryptography isn’t used to actually encrypt data. It would be too wasteful. Encryption is done with cheap symmetric ciphers (like AES) and asymmetric part is used only to negotiate the encryption key.Quote from: Bud on February 12, 2025, 01:46:42 pmThat’s an interesting claim. What is the vulnerability in mbedTLS, that leads to that conclusion?I would also ask, how state secrets got involved in this, but I’ll skip that. Now I see Siwastaja sent a message with that phrase 21 seconds before my reply.

author: radiolistener
author_rank: Super Contributor
timestamp: February 12, 2025, 03:30:48 pm
content: Quote from: Bud on February 12, 2025, 01:03:48 amI think almost all approved algorithms are already compromised...They are designed to protect against honest people who will not hack them.So there is not a big difference if its quantum resistant or not.

author: peter-h
author_rank: Super Contributor
timestamp: February 12, 2025, 04:08:36 pm
content: QuoteI just happen to be using MbedTLS and that extract in post 1 is from their mailing list. For sure nobody should be using an embedded product in some super secure application. The most likely scenario is the standard IoT stuff e.g. heating controllers, various telemetry stuff, etc. In the ref manual for my last project I tell people to only ever set it up as a client, never a server and never on an open port. You just can't be sure that 32F4 ETH + LWIP + MbedTLS is secure; there is insufficient deploymentwith open reportinggoing on.QuoteOK - a good explanation!

author: Siwastaja
author_rank: Super Contributor
timestamp: February 12, 2025, 06:42:15 pm
content: MBedTLS could be used for example on a IoT security camera, or smart lock / access logger. In such case, revealing that someone entered the home or had sex with someone would enable blackmailing or other nasty stuff even 15 years from now. Probably nothing of interest 100 years from now, though.So I wouldn't rule out the question of "quantum safe" even in the context of small embedded systems.

author: coppice
author_rank: Super Contributor
timestamp: February 12, 2025, 06:53:57 pm
content: Quantum safe means you are the smallest possible step away from being unsafe, so even the smallest improvement in attacks will kill you.

author: peter-h
author_rank: Super Contributor
timestamp: February 12, 2025, 11:30:30 pm
content: QuoteI know this is getting well off topic but for the above blackmail to work, the attacker would have to have been capturing the camera data for the 15 years, and then set about cracking it to see if there is something dodgyI guess that once the private key is calculated you can read all 15 years of traffic, but it will be a huge amount of video to go through.The realistic attack surface will be way too small for this to work, and I suspect this will be true for nearly allIoTapplications.The security camera angle has already been well tested, with AXIS IP (ETH) cameras being sold with admin/admin config on HTTP, and quite a large following of perverts watching the videos, thanks to google having indexed up the camerasA bigger problem might be cracking the private key of a high value product sold in vast numbers. An example is inkjet cartridges; the Canon private key was leaked from the factory.

author: Siwastaja
author_rank: Super Contributor
timestamp: February 13, 2025, 07:34:08 am
content: Quote from: peter-h on February 12, 2025, 11:30:30 pmDon't forget this camera could be in a home of a well-known politician or celebrity. Yellow media already goes to great lengths, some to illegal measures to spy on people like this. Imagine how difficult it is to be the president of any country. Or think about how princess Diana died.Storing 15 years of any data that can be gathered about a "person of interest" is no big deal at all. It's not even "big data". Maybe just some hundreds of GB. Totally negligible effort and cost, if you are genuinely interested about someone. And celebrities always havebunchof those stalkers hanging around.For the "average Joe" with nothing interesting going on with their life, pretty much the only risk is them being used in some sort of DDoS attack (internet activity, or think about heating controllers increasing power consumption all at the same time in an attempt to affect power grid); recovering data 15 years from now is not an issue to most.But it doesn't mean this should be completely ignored either. Some small sub-% of people can realistically have secrets they don't want to leak even in 15 years, even in their IoT devices.

author: peter-h
author_rank: Super Contributor
timestamp: February 13, 2025, 08:48:01 am
content: Right but you still need to intercept the data.Most likely route is monitoring somebody's WIFI and then you have WPA-PSK to deal with first. Is that also quantum-vulnerable? AIUI it is a shared key system.

author: rteodor
author_rank: Frequent Contributor
timestamp: February 13, 2025, 09:04:02 am
content: Veritasium video on the subject:How Quantum Computers Break The Internet... Starting Now.Lattice based Q-resistant algorithms after 17:00Later edit: correct link below inpost #22.

author: Siwastaja
author_rank: Super Contributor
timestamp: February 13, 2025, 09:46:19 am
content: Quote from: peter-h on February 13, 2025, 08:48:01 amYou can assume that part is already done. Anything else than end-to-end encrypted is known to break in the real world. If you are any kind of person of interest, that is.For example, home routers are notoriously insecure, just some random Chinese crap cobbled together in a hurry and never any security updates applied to. (+ intentional backdoors, of course).Or other IoT boxes in the same network leak. They have your wifi key configured and can listen to traffic. This is why the "safe firewalled / NATted internal network" idea is totally braindead. Everybody knows it even if you have hard time accepting it.End-to-end encryption is really the only layer of security that canactuallybe made reliably safe. Not saying even that is obvious or easy, but it'spossible.I'm not sayingeveryscript kiddie can listen to your home network traffic, but anyone with enough time, motivation and maybe some good connections to the suitable experts can, it's not limited to top-notch NSA folks. A paparazzi can do it if they are sure enough that something they can make big headlines about happens in peter-h's house.

author: peter-h
author_rank: Super Contributor
timestamp: February 13, 2025, 10:16:57 am
content: rteodorthat video has been taken down

author: rteodor
author_rank: Frequent Contributor
timestamp: February 13, 2025, 04:08:08 pm
content: Quote from: peter-h on February 13, 2025, 10:16:57 amDamn, I'm too slow for this this internet thingie ...And too bad as some of Derek graphical explanations are so good that directly imprint into memory.

author: MK14
author_rank: Super Contributor
timestamp: February 13, 2025, 04:33:39 pm
content: Quote from: rteodor on February 13, 2025, 04:08:08 pmIt seems to be here:

author: peter-h
author_rank: Super Contributor
timestamp: February 13, 2025, 06:50:01 pm
content: QuoteSiwastaja, there is a shop near hereQuoteThanks

author: 5U4GB
author_rank: Super Contributor
timestamp: February 14, 2025, 11:24:56 am
content: Quote from: Bud on February 12, 2025, 01:03:48 amAccording to someone who's actually done the math,it's not 15 years, it's 4,000 years.

author: Siwastaja
author_rank: Super Contributor
timestamp: February 14, 2025, 12:15:57 pm
content: Quote from: 5U4GB on February 14, 2025, 11:24:56 amThat's pretty fun and enjoyable reading, and it does have a point, but saying he has "done the math" is an overstatement. Clearly the presentation is meant as a joke, and the author has not done their homework, because he so strongly believes that he must be right and others wrong that he does not bother to listen what others have to say. Instead of numbers and evidence, the presenter is applying "common sense" in a way which is most likely correct, but even a trained dog can do it, and sometimes "common sense" is not correct.Even being just year or two old (I don't know, it shows 2023 as a data point), the presentation already didn't age well. The claim that quantum computing basically does not exist (and is just "physics experiment") already proved false. I was actually pretty surprised personally discussing this with a guy who does physics simulations and him telling with straight face that of course quantum computers exist, they use them all the time; they develop algorithms for them and use them to do real-world physics simulations. This is in huge contrast what you read on EEVBlog forum comments which basically claim that there are no commercial quantum computers available and all they can do is calculate 3*5=15 on a physics lab.Given that the whole premise of this presentation ended up wrong, I would not place my bets on the conclusion being correct either. (Or maybe I would do exactly that: place my bets that he's correct - point being it's a gamble, not a scientific fact.) Quantum computing breaking current asymmetric key cryptography is a possibility which either realizes or does not realize within next 10, 20, or 50 years. This author places their bets on it not realizing any time soon with not much else than their personal "hunch" or "intuition"; if they end up being wrong then they are either silent about it or say "sorry, I was wrong". Such people are often right, but not always.Also complaining about TLS being "too complex" during the time of historical simplification process of TLS (the 1.2 to 1.3 transition) simply indicates this guy... does not follow what's happening on the field he's talking about. It probably still is too complex, but claiming that somehow all the resources flow into quantum conferences is... ludicrous. I'm sure that 99% of the resources spent in data security are spent on everything else except quantum anything.The most underlying point is of course valid: we should probably be concentrating on the attacks that happen today, especially because they are mostly the same they were 5 years ago, and will remain the same for the next 5 and 10 and probably 15 years.

author: 5U4GB
author_rank: Super Contributor
timestamp: February 14, 2025, 12:27:24 pm
content: Quote from: Siwastaja on February 14, 2025, 12:15:57 pmWhy is it wrong, apart from you claiming it is? This was originally discussed on (from memory) Reddit and no-one there came up with anything to counter it.

author: coppice
author_rank: Super Contributor
timestamp: February 14, 2025, 12:54:21 pm
content: There are two essential components to a quantum computer. 1) Smoke and 2) mirrors.I don't think I've ever encountered a technology as full of BS as quantum computers. People have been making pretty much the same positive and negative claims about it since D-Wave shipped their first machine in 2011. If they were getting somewhere there should by now have been some well published result that convinces people its doing something impressive by the standards of traditional computing. I have yet to see an impressive claim that has stood up to scrutiny. This isn't to say it won't at some point be impressive, but they seem to be in that awkward phase in the development of a new technology where the only way to keep the funding going is to turn the BS up to 11.

author: Siwastaja
author_rank: Super Contributor
timestamp: February 14, 2025, 01:22:18 pm
content: Quote from: 5U4GB on February 14, 2025, 12:27:24 pmThe claim that quantum computers do not exist as computers (are not computers, it literally says so) is of course incorrect, because now quantum computers do exist: they are available for commercial use. See e.g.https://www.vttresearch.com/en/ourservices/quantum-computingI was also under belief they don't exist at all, or are completely incapable of computinganyreal-world job. A short lunch-time discussion with someone who actually writes software for them, and uses them for real-world workloads, namely multi-physics simulations, changed that view. Of course, they also said that classic computers are so far superior. And that noise is a big issue in quantum computing. No surprise there, no one is claiming otherwise.Quantum computers are still completely impractical, and incapable of breaking RSA or ECC, with nothing in sight that would change it in a few years. No one claimed otherwise.But claiming they are "just" scientific experiments unable to do anything more than a dog can do was maybe true in 2010, but not in 2023. Therefore, cherry-picking over 10 year old two datapoints and then claiming it takes 4000 year is intellectual dishonesty.Really the only one making strong and certain claims is the author you linked to. As the one making the claim, I would expect stronger evidence. And don't me wrong, I have nothing against that presentation, it's a good "let's keep our feet on the ground" wakeup presentation presented in a humorous way. But really, saying"According to someone who's actually done the math, it's not 15 years, it's 4,000 years."completely mispresents it. That is not a serious calculation, based on any serious research, but you make it sound like it is.

author: coppice
author_rank: Super Contributor
timestamp: February 14, 2025, 01:29:45 pm
content: Quote from: Siwastaja on February 14, 2025, 01:22:18 pmYou just claimed they are currently nothing more than scientific experiments at this time, yet say that claim is untrue. You aren't making sense.

author: peter-h
author_rank: Super Contributor
timestamp: February 14, 2025, 03:00:51 pm
content: From above link:VTT Q5 is a 5-qubit superconducting quantum computer co-developed and built by IQM and VTT. It is located in Espoo, Finland, at VTT.VTT Q5, also called Helmi, has been available for academic users since autumn 2022. Now, VTT Q5 is open for research and commercial users interested in developing quantum computer software and algorithms.VTT Q5 is accessible through the supercomputer LUMI. Read more on the CSC website.VTT also launched a 20-qubit quantum computer in autumn 2023. After that, we aim to build a 50-qubit quantum computer during spring 2025.Also:The number of qubits needed to break RSA encryption depends on the size of the RSA key. For example, breaking a 256-bit RSA key might require 2,500 qubits, while breaking a 2048-bit RSA key might require around 4,000 qubits. However, the exact number of qubits required is difficult to determine because it depends on other factors, such as the levels of interference and errors in the quantum computer.but the above assumes zero noise, so it is hard to extrapolate.

author: Halcyon
author_rank: Unknown
timestamp: February 15, 2025, 02:33:20 am
content: No encryption is safe, all you need is Janek's black box. ;-)

author: 5U4GB
author_rank: Super Contributor
timestamp: February 15, 2025, 05:18:02 am
content: Quote from: peter-h on February 14, 2025, 03:00:51 pmThe estimate for the number of qubits in the presence of noise, i.e. with some (well, many) used for error correction, is a million qubits. It's pure fantasy-land stuff.

author: 5U4GB
author_rank: Super Contributor
timestamp: February 15, 2025, 05:30:34 am
content: Quote from: Siwastaja on February 14, 2025, 01:22:18 pmGreat, now come back when you've used one to factor a 512-bit RSA key, which you can do with a current desktop PC.QuoteAgain, come back with newer data points. The reason why it uses those is because there are no other data points, that's all the progress that has been made in 20 years.As I said previously, simply repeating "it's wrong, it's wrong, it's wrong" isn't any kind of valid argument. If it's so wrong you should have no problems providing evidence of progress in breaking PKCs and the imminent demise of RSA or whatever via a quantum computer.

author: coppercone2
author_rank: Super Contributor
timestamp: February 15, 2025, 05:39:58 am
content: do they have like a animation or something that was made by quantum computers, like a simulation, for fluids or atoms or strain or whateveranimation, stress diagram.. graph, any output of a simulator that could be used as a 'figure'like the first useful comptuer plotted a graph which you can take a picture of and put in a book, or they made a animation of something like water across a propeller later that was recorded and shown to others on tape. did quantum computer do this?or like control a servo mechanism (like a aiming computer?) that you can record with a camera?like this

author: Bud
author_rank: Super Contributor
timestamp: February 15, 2025, 05:43:01 am
content: Everyone is fixated on using quantum computers to break encryption , but this is only one use case out of many. Quantum annealing comuters such as DWave can't run Shor algorithm at all, meaning they may never be used to break public key encryption, but that does not mean they are totally useless.

author: MK14
author_rank: Super Contributor
timestamp: February 15, 2025, 05:56:58 am
content: As soon as there is the slightest sign, that Quantum computers, are a thing and successfully cracking encryption. However, likely or unlikely, that event may be.It will be just like many of the others (possibly worse in some respects, but probably not, as Quantum computers, would probably take time, to become useful/effective hacking/cracking tools, just like most other new technological developments), in the long list of computer (security) vulnerabilities.E.g. The following link, seems to say it has 154 pages, of them:https://en.wikipedia.org/wiki/Category:Computer_security_exploitsSuch as:QuoteBut there have been, hundreds, or thousands, or even many more than that.So if it happens, we all just get to see it fixed in the various software (and/or hardware) updates/fixes.Of course, in the ideal world, these issues, would have been fixed and/or not possible and/or accounted for, well before product launch. E.g. By having much better encryption, and much more powerful testing for vulnerabilities.But, in practice, just-good-enough, so get the product out of the door, and move on to the next one, seems to be the way many things are done.

author: peter-h
author_rank: Super Contributor
timestamp: February 15, 2025, 07:23:25 am
content: The other thing is that, if needed, RSA/EC can easily move to 16k or 32k bits. Already, most serious applications use hardware acceleration for this.But it will for ever remain the case that IF somebody finds a way to rapidly factorise, that's the end. So I reckon there will be a move towards crypto which doesn't have this potential weakness.

author: golden_labels
author_rank: Super Contributor
timestamp: February 15, 2025, 07:40:46 am
content: Nobody is “obsessed.” This is a reaction to a potential vulnerability, which can be easily avoided. It’s a steady process of improvement, no different than the normal moving away from older cryptographic primitives in favor of better ones. We do this all the time and usually at much faster pace and more radical push than it is with post-quantum cryptography.Please don’t confuse alarmist articles in news with reality of what the computer security world does.GCM became the preferred mode and thare was (and is) a strong push for AE(AD). Journalists failed to comment? Nobody cared, nobody seen that as “obsession,” you probably don’t even know the change did happen and your browser and most other TLS clients now use GCM.Forward secrecy became the norm or even a requirement. Journalists failed to comment? Nobody cared, nobody seen that as “obsession,” you probably don’t even know the change did happen, your browser now prefers it, and some sites will not let you connect with non-FS choices.ECC certs are now offered as something normal, and preferred where possible. Journalists failed to comment? Nobody cared, nobody seen that as “obsession,” you probably don’t even know if the site you connect to uses RSA or ECC.OCSP stapling becomes a default built-in in servers? Journalists failed to comment? Nobody cared, nobody seen that as “obsession,” you probably don’t even know about its introduction and can’t tell if it’s in use for your connection.People 30 years ago noticed there is a potential problem. It affects something that already had foundational issues since the inception. The industry and academia, now two generations of people, slowly work towards finding a better solution. Journalists comment from time to time? Suddenlyeverybodyhas strong opinions.I don’t know everything, and my brain also can’t process questions requiring enumeration. But I can’t come up with a single example of any other change in modern cryptography, that would take longer, be slower and less exciting, than the walk towards PQC. Even (general) homomorphic crypto is hotter.

author: 5U4GB
author_rank: Super Contributor
timestamp: February 15, 2025, 08:41:37 am
content: Quote from: golden_labels on February 15, 2025, 07:40:46 amOCSP, and more generally the whole concept of blacklist-based "security", never worked, being the#1 and #2 dumbest ideas in computer security, which is why browsers stopped paying attention to it and major CAs like Let's Encrypt are shutting down their OCSP servers.

author: golden_labels
author_rank: Super Contributor
timestamp: February 15, 2025, 10:30:47 am
content: Not sure, how the current status of OCSP relates to how people reacted in the past. Even less clear, given I wrote about stapling, but the reply confuses it with clients’ OCSP requests.But let’s continue, because the reply is somewhat misleading.Word “blacklist” when describing OCSP has a different meaning than when used in criticism of the “default allow” security. We can’t connect two things simply because the same sequence of letters may appear in their descriptions. There has to be conceptual equivalence. In this case it’s missing. The “default deny (and whitelist)” and “default allow (and blacklist)” approaches are the base security. It’s the mandatory part. If we do that wrong, we don’t have security. And we now know, that a wall can’t be built by putting bricks where the enemy is seen. But OCSP is supplemental security. If we do that right, we get extra protection, but if it doesn’t work, nothing is lost. The use of blacklisting was never criticized,(1)when it’s about those additional solutions.OCSP is now phased out. But you made it sound, as if the motivation was to remove it due to the “blacklisting” part.Not only it’s not among the reasons, but in fact it’s opposite: it’s being replaced by another blacklisting solution (CRL).It’s also OCSP, not OCSP stapling. The latter is removed not due to any weakness. It goes away because verifying OCSP stapling has lower share among clients than CRL. And — with client OCSP gone and CRL in place — running the service would be wasteful.(1)Not for its weakness at least. There are other reasons, like being unneeded or poorly executed.

author: 5U4GB
author_rank: Super Contributor
timestamp: February 16, 2025, 07:20:51 am
content: Quote from: golden_labels on February 15, 2025, 10:30:47 amI was referring to the general concept behind how is-it-valid-now checking is done for certs, which is "this certificate is good unless you hear otherwise", which is default-allow.In terms of CRLs replacing OCSP, first there were CRLs, which didn't work, so they were replaced by OCSP, which didn't work, so now they're being replaced by CRLs again. They're still not going to work, which is why many CA's are going to short-lived certs (which also don't work) and then there's also CT, which seems to be the only thing that has a hope of working but also completely defeats the point of certificates since if you're going to do an online query to a CT log you don't need signed certificates and chains of trust and whatnot any more.CT is actually going back to the original 1970s concept for validity checking where you do an online query to check whether the thing you've got is OK. Since this would have required dropping the X.25 virtual circuit you were on to do the lookup, Loren Kohnfelder came up with the concept of certificates to avoid the online lookup. And we've been stuck with this half-century-old offline view of things in an entirely online world ever since.

author: golden_labels
author_rank: Super Contributor
timestamp: February 16, 2025, 10:04:46 am
content: Quote from: 5U4GB on February 16, 2025, 07:20:51 amNo, it is not.(1)And I already explained that in the post to which you reply.Security of certificates doesn’t depend in a slightest way on OSCP (or CRL). It depends entirely and completely on the cryptographic features and the secret remaining secret. There is no other factor involved, OSCP, CRL, or otherwise, blacklist, whitelist, or otherlist. The principle is no different than that found in symmetric cryptography, ancient ciphers, or evenargots.(tabA)But since there is a secret, there is a problem: the secret may leak.(2)What then? For this anadditionalmechanism is provided. It’s not a part of the original cryptography. It is addressing a separate issue. For certificates the mechanism is to allow key owners to announce the key has been compromised. CRLs, OCSP requests, and OCSP stapling are how it’s announced. But, I repeat: the cryptography and its security doesn’t depend on those at all. It’s supplementary. Which is also why OCSP requests failure treatment was considered a thing to improve, but never a critical vulnerability. It’s an extra chain placed around Fort Knox.(1)Not without widening the meaning of “default-allow” by so much, that it unavoidably renders entire cryptography useless. Which would be absurd.(2)From population/policies perspective “may” is replaced with “will.”(tabA)A short table depicting parallels. Quickly sketched, so don’t cite me on that:Code:,-------------------+------------------------+----------------+----------------.| What | Security feature | Based in | Secret |+-------------------+------------------------+----------------+----------------+| Assymetric | Secret-key encyption, | Maths | Private keys || | signatures | | || | | | || Symmetric | Symmetric block/stream | Maths | Shared key || | ciphers, operation | | || | mode | | || | | | || Espionage (hist.) | Substitution | Obscurity | Codebook || | | | || Ancient ciphers | Substitution, | Obscurity | Pre-negotiated || | scrambling | | procedures || | | | or numbers || Argots | Substitution, entry | Obscurity, | Argot || | barriers, murder | dissemination | itself || | | delay | |`-------------------+------------------------+----------------+----------------'

author: coppercone2
author_rank: Super Contributor
timestamp: February 19, 2025, 07:11:48 am
content: also a quantum safe hmm could you hide a atom in there? so you can't find out what atom is in there without destroying it unless you know.. somethingits like a really small mystery box? It should also be heavy so its hard for a nanobot to run off with it, it would get a quantum beating from security forces waddling around when its overloaded with a heavy safe