Send tor-dev mailing list submissions to
tor-dev@xxxxxxxxxxxxxxxxxxxx
To subscribe or unsubscribe via the World Wide Web, visit
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-dev
or, via email, send a message with subject or body 'help' to
tor-dev-request@xxxxxxxxxxxxxxxxxxxx
You can reach the person managing the list at
tor-dev-owner@xxxxxxxxxxxxxxxxxxxx
When replying, please edit your Subject line so it is more specific
than "Re: Contents of tor-dev digest..."
Today's Topics:
1. Re: Quantum-safe Hybrid handshake for Tor (Ryan Carboni)
2. Re: Quantum-safe Hybrid handshake for Tor (Yawning Angel)
Message: 1
Date: Fri, 1 Jan 2016 19:33:31 -0800
From: Ryan Carboni <ryacko@xxxxxxxxx>
To: tor-dev@xxxxxxxxxxxxxxxxxxxx
Subject: Re: [tor-dev] Quantum-safe Hybrid handshake for Tor
Message-ID:
<CAO7N=i2MspE1N5eOczCyT9RCPORgUJboSOY3vUMGKL5FSzAPnw@xxxxxxxxxxxxxx>
Content-Type: text/plain; charset="utf-8"
The first step should be replacing the long-term keys with quantum-safe
crypto.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.torproject.org/pipermail/tor-dev/attachments/20160101/14b4bd21/attachment-0001.html>
Message: 2
Date: Sat, 2 Jan 2016 04:19:28 +0000
From: Yawning Angel <yawning@xxxxxxxxxxxxxxx>
To: tor-dev@xxxxxxxxxxxxxxxxxxxx
Subject: Re: [tor-dev] Quantum-safe Hybrid handshake for Tor
Message-ID: <20160102041928.15e0cbc3@xxxxxxxxxxxxxxx>
Content-Type: text/plain; charset="us-ascii"
On Fri, 1 Jan
2016 19:33:31 -0800
Ryan Carboni <ryacko@xxxxxxxxx> wrote:
The first step should be replacing the long-term keys with
quantum-safe crypto.
Wrong.
There are NO usable PQ signature primitives that are suitable for
deployment. Adding 1408+ bytes to every single microdescriptor is
not a realistic proposition. Signing is also quite expensive unless you
have AVX2, and will decimate circuit build performance.
Protecting against Quantum Computer equipped active Man-In-The-Middle
attacks is the least important thing to do in terms of user safety.
By modifying the link handshake to incorporate a PQ key exchange
algorithm with ephemeral keys as in the proposal, user data being
generated right now will be protected from bulk decryption later, in
the event of
a Curve25519 break (probably by a large enough Quantum
Computer), which is a far more realistic threat to be concerned about.