Schneier on Security

Clive Robinson • October 23, 2024 4:22 AM

@ SevenKeys,

“Unless they deliberately “leaked” this information to lull us into a false sense of security, that our RSA/AES are a long way from being broken.”

You are only thinking of time going in one direction, with information that has no mass or energy thus no forensic footprint it’s different.

Think of a digitally signed contract for like a land lease etc. That is a contract that could be valid for a thousand or more years (there is one in Ireland for longer with a well known brewery). Traditionally such contracts are protected by being registered and copies kept with an impartial agent (such as a Gov Land Registry). However impartial agents cost significant money to run and have all sorts of issues with “historic document preservation”. Modern neo-con arguments are that this is inefficient and should be replaced with something less expensive (even if one heck of a lot less secure).

As long as the “secret key” remains secret the contract should be not just “unalterable” but “verifiable” as well.

Now imagine that you can find the secret key from the public key in less than fifty years. This in effect puts an “end of life” on all contracts at between seven to fifty years.

After that you can nolonger trust the digital signed contract as being original thus accurate…

Traditional paper or velum contracts at least have forensics that can assist in authenticating their age and provenance, digital information does not.

It’s an argument “Blockchain” people like, but when you consider the power consumption of a blockchain then the cost can be a lot higher than expected and not even realistically secure either. Because what ails PubKey systems with QC also has an effect on anything else based on “One Way Functions”(OWFs).

Clive Robinson • October 24, 2024 5:12 PM

@ Who?

Re : Encryption v encryption.

You ask,

“[W]ould China (or any other country) announce they have the ability to break military-grade encryption if they really can do it?”

The answer is actually quite interesting.

In essence there are three types of Pre “Post-Quantum Computing”(PQC) encryption systems,

1, Systems using genuinely nondeterministic keys as long as the message that should –if used correctly– have “Perfect Secrecy”.

2, Symmetrically keyed systems that use relatively short (say 256bit) keys that “Quantum Computing”(QC) does not have significant effects against (basically doubling of key length).

3, Pre QC Asymmetric keyed systems that use large key sizes (8Kbits and up pre Quantum Computing).

The question then becomes one of what the types are used for.

The “perfect secrecy” type systems are usually simple to use need little more than a pencil and box of matches along with what is often called the “One Time Pad”. The downside is also the upside, in that the amount of “Key-Material”(KeyMat) is the same or more as the message length. Thus in military and some commercial use they do get used for “Engineering Order Wire”(EOW) use. One such is emergency key transfer to bring “Asymmetric Systems” back up after a critical event such as power failure or “bug out”.

The military in many places favour Asymmetric Crypto systems because they have many advantages. One such is sending null traffic to reduce the effects of enemy “traffic analysis”.

Apart from the US, Asymmetric Systems tend to be avoided by many diplomatic, military, and certain major commercial systems, where symmetric systems are trusted and thus favoured.

However Asymmetric Systems are what the “Internet Economy” can not run without, and that is a major problem.

Consider the US and China usage of electronic communications and the Internet…

The entire US economy needs the Asymmetric Systems to function in all but a very minor handful of financial systems.

Back when the “Obama Big Red Off Button” was touted it quickly became clear the US would very probably die in at most 30days without the Internet… Various “minor” effects on the Internet since has shown this not to be a “hypothetical danger” where some one had their maths wrong.

China still has communications systems that are separate to the Internet for good reason. Although China would be effected by the Internet becoming stopped, China’s entire Internet design is one where “secrecy” is actively worked against by the government for “Political Control” and Surveillance reasons (hence the separate communications systems and research into “Quantum Crypto” which has “Perfect Secrecy” via the current accepted laws of physics).

Quantum Computing if it happens in a short period of time is going to hurt the US way way more than China. Even the threat of it has a way more significant “Chilling Effect” on the US and the West than China.

So as far as “economic warfare” is concerned Quantum Computing is the equivalent of a high yield fussion bomb for the US and West. But to China little more than limited range field artillery. That is it is “Very Asymmetric In Use”.

Interestingly though, the original paper is not hype or propaganda. That was done by a certain MSM outlet that aims at the US and West in it’s reporting, and this would not be it’s first “Chicken Little” type piece.

Do the US and the West need to reduce it’s reliance on the Internet, the obvious answer is “yes”. But then neo-con mantra is such that dependence on the Internet will be increased in just about every way possible and,

“Security of nation, economy, and citizens be dammed…”