Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

As a side question: What is the NIST post-quantum debacle? Could you give some references?


One of their post-quantum bets did not work out.

https://news.ycombinator.com/item?id=30466063


Ah, that actually wasn't the debacle I had in mind; I'm not too familiar with the details of the Rainbow concerns unfortunately.

With respect to the shortest vector problem (SVP) being a point of contention among NIST PQC participants, two of the round 3 finalists are based on lattice cryptography, with NTRU directly relying on the hardness of SVP. The two concerns are:

1. The risks of lattice-based cryptography are poorly understood [1], [2]

2. Research progress into attacks on lattice-based cryptography have been fruitful during the NIST PQC process [1], [3].

From what I've gathered as a layperson, much of these concerns have been voiced by Daniel J. Bernstein. Bernstein contributed to the NTRU Prime software [4], which was used in OpenSSH 9 (I'll circle back to this point). As a consequence of these two concerns, the main argument seems to be that NIST should at least provide warnings [6] on the risks of lattice cryptography, particularly with regard to the use of cyclotomics by one of the finalists [5].

A common thread amongst these criticisms seems to be a distrust of NIST guidelines (a point that is also echoed by this ML backdoor paper). This has evidently stirred some bad blood between NIST workers and Bernstein [7], [8]. I'm sure to there's more to the story (especially since Bernstein's NTRU prime was a NIST PQC candidate), but I suppose NIST isn't free from passive-aggressiveness?

Within the context of this bad-blood, it's amusing that OpenSSH 9 uses Bernstein's NTRU Prime (doesn't use cyclotomics iirc), as opposed to one of NIST PQC's finalists.

(DISCLAIMER: I'm a layperson, and I encourage people to read the sources themselves to make an informed opinion. People are welcome to correct. )

[1] - See the link to the "Risks of lattice KEMs" PDF at the top: https://ntruprime.cr.yp.to/warnings.html

[2] - https://groups.google.com/a/list.nist.gov/g/pqc-forum/c/Fm4c...

[3] - https://groups.google.com/a/list.nist.gov/g/pqc-forum/c/4iaf...

[4] - https://ntruprime.cr.yp.to/index.html

[5] - https://groups.google.com/a/list.nist.gov/g/pqc-forum/c/7Whv...

[6] - https://groups.google.com/a/list.nist.gov/g/pqc-forum/c/KFgw...

[7] - https://groups.google.com/a/list.nist.gov/g/pqc-forum/c/Fm4c...

[8] - [PDF] - https://csrc.nist.gov/csrc/media/Projects/post-quantum-crypt...




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: