📅 Original date posted:2018-05-08
📝 Original message:
Sorry, I do not wish to spam the list, but I need to correct a rather
serious error in my last email. We must never call something
"post-quantum", absent mathematical proof. (And good luck with that.) I
apologise for my mistake in doing so myself.
I should not even refer to lattice based cryptography as a post-quantum
algorithm, I should at best call it a Shor's algorithm-resistant scheme. At
least, it is not (yet) known how Shor's algorithm could be used to break
it. Not in public circles, anyhow.
A cursory glance at the history of cryptanalysis shows that primitives
generally have finite life, which makes it odd that systems seldom use
redundant primitives, and seldom provide for their rapid and safe swap. A
system whose entire security rests on nothing but cryptography, ought to
take particular care! The spectre of quantum computers may render the
finite life of certain primitives more salient than others, but we must not
suppose that, absent Shor's algorithm, there would be no need to plan for
cryptographic failures. The question is not if, but when, Bitcoin and
lightning will contend with broken primitives, whether due to classical or
quantum cryptanalysis. Likely, both will come into play at various times,
and one must plan accordingly.
On Tue, May 8, 2018, 9:09 AM Benjamin Mord <ben at mord.io> wrote:
>
> That would be awesome. Do you have a reference?
>
> As pertains to the whole of asymmetric cryptography, I believe there are
> not a variety of post quantum schemes, there is only one*: lattice-based
> cryptography. (Which scares me, because it is not all that different from
> the others.)
>
> (* Actually, in contexts where time can be used for asymmetry, as in
> TESLA, we can then use hash functions to create something like asymmetric
> signatures as well. But the functional context has to be compatible with
> delayed verification.)
>
> (But I do not mean to focus exclusively on Schor's algorithm, the history
> of even pre-quantum cryptanalysis shows that primitives tend to have finite
> lifespan. Redundancy of any sort of good, even when not focused
> specifically on quantum risks.)
>
> On Tue, May 8, 2018, 8:58 AM Greg Sanders <gsanders87 at gmail.com> wrote:
>
>> From what I understand talking to folks, the linear properties of these
>> signature tricks are maintained under a number of post-quantum schemes.
>>
>> On Tue, May 8, 2018 at 8:44 AM, Benjamin Mord <ben at mord.family> wrote:
>>
>>>
>>> If I'm not mistaken, the scriptless scripts concept (as currently
>>> formulated) falls to Schor's algorithm, and at present there is no
>>> alternative implementation of the concept to fall back on. Correct? Lest we
>>> build a house of cards, I'd strongly urge everyone to not depend on
>>> functional concepts whose underlying cryptographic primitives cannot be
>>> swapped in an emergency.
>>>
>>> Sure, we use ecdsa for example (which is also vulnerable to Schor's
>>> algorithm), but in contrast to scriptless scripts we have a variety of
>>> backup primitives at our disposal that fulfill the same functional
>>> objective.
>>>
>>> If scriptless scripts are found possible under lattice-based
>>> cryptography for example, that would be something I suppose. The functional
>>> concept of scriptless scripts is indeed very awesome - we just need to add
>>> some cryptographic conservatism before we build on it.
>>>
>>>
>>> _______________________________________________
>>> Lightning-dev mailing list
>>> Lightning-dev at lists.linuxfoundation.org
>>> https://lists.linuxfoundation.org/mailman/listinfo/lightning-dev
>>>
>>>
>>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.linuxfoundation.org/pipermail/lightning-dev/attachments/20180508/664c63d0/attachment-0001.html>;
Benjamin Mord [ARCHIVE] /
npub16y…kjvwy
2023-06-09 12:50:41
in reply to nevent1q…hrpz
Author Public Key
npub16ycdmhx5sct3h37cwvjff8le7qlp9k0ngst5ry5n262j6gkesrssskjvwyPublished at
2023-06-09 12:50:41Event JSON
{
"id": "b052bf3999a07736f99c62b443445f3c4bee8f24a3b197928667e9cc5d8c9d3f",
"pubkey": "d130dddcd486171bc7d87324949ff9f03e12d9f3441741929356952d22d980e1",
"created_at": 1686315041,
"kind": 1,
"tags": [
[
"e",
"a140aca1ee6330ebac0e6e71b974dad50152279c9e0bbc01b5138c6fc06c41b5",
"",
"root"
],
[
"e",
"4610277f88be4f0e2af699d5cbee18365d4218393433fd0a1b5fe831a52e7980",
"",
"reply"
],
[
"p",
"d130dddcd486171bc7d87324949ff9f03e12d9f3441741929356952d22d980e1"
]
],
"content": "📅 Original date posted:2018-05-08\n📝 Original message:\nSorry, I do not wish to spam the list, but I need to correct a rather\nserious error in my last email. We must never call something\n\"post-quantum\", absent mathematical proof. (And good luck with that.) I\napologise for my mistake in doing so myself.\n\nI should not even refer to lattice based cryptography as a post-quantum\nalgorithm, I should at best call it a Shor's algorithm-resistant scheme. At\nleast, it is not (yet) known how Shor's algorithm could be used to break\nit. Not in public circles, anyhow.\n\nA cursory glance at the history of cryptanalysis shows that primitives\ngenerally have finite life, which makes it odd that systems seldom use\nredundant primitives, and seldom provide for their rapid and safe swap. A\nsystem whose entire security rests on nothing but cryptography, ought to\ntake particular care! The spectre of quantum computers may render the\nfinite life of certain primitives more salient than others, but we must not\nsuppose that, absent Shor's algorithm, there would be no need to plan for\ncryptographic failures. The question is not if, but when, Bitcoin and\nlightning will contend with broken primitives, whether due to classical or\nquantum cryptanalysis. Likely, both will come into play at various times,\nand one must plan accordingly.\n\nOn Tue, May 8, 2018, 9:09 AM Benjamin Mord \u003cben at mord.io\u003e wrote:\n\n\u003e\n\u003e That would be awesome. Do you have a reference?\n\u003e\n\u003e As pertains to the whole of asymmetric cryptography, I believe there are\n\u003e not a variety of post quantum schemes, there is only one*: lattice-based\n\u003e cryptography. (Which scares me, because it is not all that different from\n\u003e the others.)\n\u003e\n\u003e (* Actually, in contexts where time can be used for asymmetry, as in\n\u003e TESLA, we can then use hash functions to create something like asymmetric\n\u003e signatures as well. But the functional context has to be compatible with\n\u003e delayed verification.)\n\u003e\n\u003e (But I do not mean to focus exclusively on Schor's algorithm, the history\n\u003e of even pre-quantum cryptanalysis shows that primitives tend to have finite\n\u003e lifespan. Redundancy of any sort of good, even when not focused\n\u003e specifically on quantum risks.)\n\u003e\n\u003e On Tue, May 8, 2018, 8:58 AM Greg Sanders \u003cgsanders87 at gmail.com\u003e wrote:\n\u003e\n\u003e\u003e From what I understand talking to folks, the linear properties of these\n\u003e\u003e signature tricks are maintained under a number of post-quantum schemes.\n\u003e\u003e\n\u003e\u003e On Tue, May 8, 2018 at 8:44 AM, Benjamin Mord \u003cben at mord.family\u003e wrote:\n\u003e\u003e\n\u003e\u003e\u003e\n\u003e\u003e\u003e If I'm not mistaken, the scriptless scripts concept (as currently\n\u003e\u003e\u003e formulated) falls to Schor's algorithm, and at present there is no\n\u003e\u003e\u003e alternative implementation of the concept to fall back on. Correct? Lest we\n\u003e\u003e\u003e build a house of cards, I'd strongly urge everyone to not depend on\n\u003e\u003e\u003e functional concepts whose underlying cryptographic primitives cannot be\n\u003e\u003e\u003e swapped in an emergency.\n\u003e\u003e\u003e\n\u003e\u003e\u003e Sure, we use ecdsa for example (which is also vulnerable to Schor's\n\u003e\u003e\u003e algorithm), but in contrast to scriptless scripts we have a variety of\n\u003e\u003e\u003e backup primitives at our disposal that fulfill the same functional\n\u003e\u003e\u003e objective.\n\u003e\u003e\u003e\n\u003e\u003e\u003e If scriptless scripts are found possible under lattice-based\n\u003e\u003e\u003e cryptography for example, that would be something I suppose. The functional\n\u003e\u003e\u003e concept of scriptless scripts is indeed very awesome - we just need to add\n\u003e\u003e\u003e some cryptographic conservatism before we build on it.\n\u003e\u003e\u003e\n\u003e\u003e\u003e\n\u003e\u003e\u003e _______________________________________________\n\u003e\u003e\u003e Lightning-dev mailing list\n\u003e\u003e\u003e Lightning-dev at lists.linuxfoundation.org\n\u003e\u003e\u003e https://lists.linuxfoundation.org/mailman/listinfo/lightning-dev\n\u003e\u003e\u003e\n\u003e\u003e\u003e\n\u003e\u003e\n-------------- next part --------------\nAn HTML attachment was scrubbed...\nURL: \u003chttp://lists.linuxfoundation.org/pipermail/lightning-dev/attachments/20180508/664c63d0/attachment-0001.html\u003e",
"sig": "16d1b7750340018795353750c5b078e47d321776b11bdf6f84d21622cba12205ee6063eab43a340935df0923b03d4973f75b69243a12f6776e3959378791ceed"
}