Re: Cipher suits, signature algorithms, curves in Firefox

Hubert Kario <[email protected]> Wed, 11 May 2016 15:29:27 +0200

Newsgroups	gmane.comp.mozilla.crypto
Message-ID	<[email protected]>

On Friday 06 May 2016 10:34:37 Zoogtfyz wrote:
> > the larger key size helps w.r.t. quantum computers.
> 
> If quantum computers are currently on the level of breaking AES-128,
> then they are on the level of breaking any asymmetric cryptography
> (RSA, DHE or ECDHE key exchange) we are using - which makes support
> for AES-256 moot.

That's not correct.

Grover's algorithm requires you to perform 2^(n/2) operations to break 
symmetric crypto, and it uses n qbits to do that. To break aes-128 you 
need quantum computer with 128 qbits, and 2^64 operations. To break 
AES-256 you need 256 qbits and 2^128 operations.

To break RSA you need quantum computer which can do Shor's algorithm, 
which requires n*3/2 qbits and around (log n)^2 operations. So for 2048 
bit RSA you need 3072 qbit QC and about 83 operations.

In other words, quantum computer that breaks AES-128 can't even scratch 
RSA. Quantum computer that breaks AES-256 doesn't make it possible to 
actually recover plaintext, and it still don't break currently used RSA.

> Moving away from AES-256 will put even more
> pressure on the crypto community to come up with a solution as
> opposed to the *relative* complacency we are seeing now.

I don't think we are in the position to demand crypto community to do 
anything in particular...

-- 
Regards,
Hubert Kario
Senior Quality Engineer, QE BaseOS Security team
Web: www.cz.redhat.com
Red Hat Czech s.r.o., Purkyňova 99/71, 612 45, Brno, Czech Republic

-- 
dev-tech-crypto mailing list
[email protected]
https://lists.mozilla.org/listinfo/dev-tech-crypto

signature.asc (application/pgp-signature, 819 B)