@Tom sadly I'm less technical in this space (my Crypto ended about 4 chapters before the end of the Handbook of Applied Cryptography) but I'll maybe hang about a bit more here as an impartial observer

@RoryAlsop sounds great to me

@RoryAlsop looks like you're deeply embedded in industry. I'm sure banks are looking seriously at signing and the threat of quantum and attacks on RSA etc!

\o @Rory

@Tom quantum is far less of a worry than you might imagine, as solutions are already very Well understood

Similarly attacks on RSA are not much of a concern

When quantum crypto attacks become effective, we already know a number of algorithms to move to

@ArtOfCode evenin

@RoryAlsop but I wouldn't yet consider any of them (excpet hash sigs and maybe code-based crypto) "large-scale production ready"?

@RoryAlsop that seems reasonable to me, it's not like there aren't functional quantum-safe signature schemes. and from what I've heard about industry everything is thought of many years before it's a real problem (if the problem is known about)

yes, I would expect there are people wanting leaner schemes etc

My estimate is 8-10 years before we need to implement

looks like i'm just in time! ;)

Lol

@SEJPM true, but the attacks aren't production ready either :-)

@RoryAlsop good point

@RoryAlsop production-readiness of crypto-attacks is considere an "implementation detail", you know that ;)

Heh heh heh

in a way though, we can never be sure what technology is out there so I think it's prudent to move to safe ground sooner rather than later

@Tom IIRC those cheated

@SEJPM I think the paper was from harvard so, would have to check!

@Tom they cheated in the sense as they didn't factor "general" numbers but rather numbers with specific properties, IIRC it was a relatively low distance between p and q that was required

The speed of quantum algos doesn't really matter that much. What matters is getting enough entangled bits.

@SEJPM I guess what I think is that with the field wide open for new algorithms in quantum it seems likely there will be more attacks possible, and so like I said it's smart to avoid the problem altogether. but I'll take your word for it on that case

It's far more important to get confidentiality to PQ than getting signatures there is.

@CodesInChaos PQ RSA got you covered!

:rolleyes:

DJB can't even think of new jokes and recycles his old ones

eprint.iacr.org/2017/351

@CodesInChaos yeah, my interest in signatures is only because I think I have an insight into doing it in a more-practical way than the other major schemes I've read about

@CodesInChaos you should make sure to communicate your disappointment via twatter :p

@SEJPM have you seen the memory required for that

He already did that one when he published the McBits thingy

@Tom yes

It was just to ridicule the people who complained about the McEliece key sizes by attacking a strawman. Typical DJB...

@CodesInChaos have you looked at my paper with the pseudo code? (docdro.id/lWUHV5c)

cr.yp.to/talks/2010.05.28/slides.pdf