📅 Original date posted:2013-08-05
📝 Original message:Whoops, I didn't mean to run us down the Quantum Computing debate path.
I was simply using my experience with QCs as a basis for questioning the
conclusion that ECDLP is so much more robust than RSA/factoring
problems. It's possible we would simply be jumping from one burning
bridge to another burning bridge by rushing to convert everything to ECC
in the event of a factoring breakthrough.
>From the perspective of quantum computers, it seems those two problems
are essentially the same. As I said, I remember that one of the
problems is solved by using the solution/circuit for the other. But I
don't know if this relationship holds outside the realm of QCs. The
guy who did this presentation said he's not a mathematician and/or
cryptographer, yet he still strongly asserts the superiority of ECDLP.
I'm not convinced.
On 08/05/2013 01:29 AM, John Dillon wrote:
> On Mon, Aug 5, 2013 at 3:30 AM, Peter Vessenes <peter at coinlab.com> wrote:
> > I studied with Jeffrey Hoffstein at Brown, one of the creators of
NTRU. He
> > told me recently NTRU, which is lattice based, is one of the few (only?)
> > NIST-recommended QC-resistant algorithms.
>
> > We talked over layering on NTRU to Bitcoin last year when I was out that
> > way; I think such a thing could be done relatively easily from a crypto
> > standpoint. Of course, there are many, many more questions beyond
just the
> > crypto.
>
> Is NTRU still an option? My understanding is that NTRUsign, the
algorithm to
> produce signatures as opposed to encryption, was broken last year:
>
http://www.di.ens.fr/~ducas/NTRUSign_Cryptanalysis/DucasNguyen_Learning.pdf
>
> Having said that my understanding is also that the break requires a few
> thousand signatures, so perhaps for Bitcoin it would still be
acceptable given
> that we can, and should, never create more than one signature for any
given key
> anyway. You would be betting that improving the attack from a few thousand
> signatures to one is not possible however.
>
> In any case, worst comes to worst there are always lamport signatures.
If they
> are broken hash functions are broken and Bitcoin is fundementally broken
> anyway, though it would be nice to have alternatives that are similar
is pubkey
> and signature size to ECC.
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.linuxfoundation.org/pipermail/bitcoin-dev/attachments/20130805/37d7063b/attachment.html>;
Alan Reiner [ARCHIVE] /
npub1sm…mnq7h
2023-06-07 15:05:31
in reply to nevent1q…pc37
Author Public Key
npub1sm6zhjmk5scuz294jmpkw99wwwjzetjgwp4fu4gn6utqgdz87hkqamnq7hPublished at
2023-06-07 15:05:31Event JSON
{
"id": "3c781b5786868f5dffd999967f88eac8ef6cc37b98165c903e686e325010325a",
"pubkey": "86f42bcb76a431c128b596c36714ae73a42cae48706a9e5513d716043447f5ec",
"created_at": 1686150331,
"kind": 1,
"tags": [
[
"e",
"2f2b62dd902f5a8ee01bc2d15f13cdd2131ceb5ca279e6603f849aa0430311f2",
"",
"root"
],
[
"e",
"24a1bf3c80c48816a734d3deabbddfe08a4b1011828ec62f9bde8f21f8614e7d",
"",
"reply"
],
[
"p",
"a0b592adfee20cad7bb28c238a9fc1fccf4511a458be8e3d96b00c914c8c3564"
]
],
"content": "📅 Original date posted:2013-08-05\n📝 Original message:Whoops, I didn't mean to run us down the Quantum Computing debate path. \nI was simply using my experience with QCs as a basis for questioning the\nconclusion that ECDLP is so much more robust than RSA/factoring\nproblems. It's possible we would simply be jumping from one burning\nbridge to another burning bridge by rushing to convert everything to ECC\nin the event of a factoring breakthrough.\n\n\u003eFrom the perspective of quantum computers, it seems those two problems\nare essentially the same. As I said, I remember that one of the\nproblems is solved by using the solution/circuit for the other. But I\ndon't know if this relationship holds outside the realm of QCs. The\nguy who did this presentation said he's not a mathematician and/or\ncryptographer, yet he still strongly asserts the superiority of ECDLP. \nI'm not convinced.\n\n\nOn 08/05/2013 01:29 AM, John Dillon wrote:\n\u003e On Mon, Aug 5, 2013 at 3:30 AM, Peter Vessenes \u003cpeter at coinlab.com\u003e wrote:\n\u003e \u003e I studied with Jeffrey Hoffstein at Brown, one of the creators of\nNTRU. He\n\u003e \u003e told me recently NTRU, which is lattice based, is one of the few (only?)\n\u003e \u003e NIST-recommended QC-resistant algorithms.\n\u003e\n\u003e \u003e We talked over layering on NTRU to Bitcoin last year when I was out that\n\u003e \u003e way; I think such a thing could be done relatively easily from a crypto\n\u003e \u003e standpoint. Of course, there are many, many more questions beyond\njust the\n\u003e \u003e crypto.\n\u003e\n\u003e Is NTRU still an option? My understanding is that NTRUsign, the\nalgorithm to\n\u003e produce signatures as opposed to encryption, was broken last year:\n\u003e\nhttp://www.di.ens.fr/~ducas/NTRUSign_Cryptanalysis/DucasNguyen_Learning.pdf\n\u003e\n\u003e Having said that my understanding is also that the break requires a few\n\u003e thousand signatures, so perhaps for Bitcoin it would still be\nacceptable given\n\u003e that we can, and should, never create more than one signature for any\ngiven key\n\u003e anyway. You would be betting that improving the attack from a few thousand\n\u003e signatures to one is not possible however.\n\u003e\n\u003e In any case, worst comes to worst there are always lamport signatures.\nIf they\n\u003e are broken hash functions are broken and Bitcoin is fundementally broken\n\u003e anyway, though it would be nice to have alternatives that are similar\nis pubkey\n\u003e and signature size to ECC.\n\u003e\n\n-------------- next part --------------\nAn HTML attachment was scrubbed...\nURL: \u003chttp://lists.linuxfoundation.org/pipermail/bitcoin-dev/attachments/20130805/37d7063b/attachment.html\u003e",
"sig": "ae3bc01bb707b738409f8787eddab217e5613411ea513be4e65c791325136a211c5132daf17dc263b57691d19fb3e503a6b78877058ab8ddcfeb7bc538b690f0"
}