6 ms·

Obligatory djb warnings: https://ntruprime.cr.yp.to/warnings.html https://ntruprime.cr.yp.to/warnings.html

by dsp 4y ago

mixedmath 4y ago
What does "djb" mean here?
- Retr0id 4y ago
  https://en.wikipedia.org/wiki/Daniel_J._Bernstein https://en.wikipedia.org/wiki/Daniel_J._Bernstein
kzrdude 4y ago
Is djb involved in any of the standardized algorithms here by the way?
- markschultz 4y ago
  Yes, many. I believe he's on the SPHINCS+ team (was standardized), Classic McCliece (round 3, not standardized), and NTRU_PRIME (round 3, passed over for Kyber). Perhaps more, but he has significant skin in the game.
deleted 4y ago
[deleted]
0des 4y ago
should really be higher up.
bawolff 4y ago
Isn't that the point of having "hybrid" mode?
- api 4y ago
  HMAC(pqc_shared_secret, ecc_shared_secret)
forty 4y ago
What's the "obligatory djb warnings"? Something like "any crypto that's not mine isn't great"? ;)
- sterlind 4y ago
  from skimming it, his main argument is that Kyber relies on many constructions (e.g. cyclotomic polynomials) that are actively under attack - researchers have been successfully chipping away at them and show no signs of stopping. he also alleges that NIST have been moving the goal posts to favor Kyber, and they've been duplicitous in their narrative. he favors NTRU, which iirc isn't his.
  - markschultz 4y ago
    Cyclotomic polynomials are incredibly standard in the field. The only researcher I know of who has issues with them is DJB, and there has not been significant advances in cryptanalysis due to usage of cyclotomics (with the exception of problems not used by NIST candidates, meaning the whole SOLIQUAY thing)
  - mti 4y ago
    NTRU also relies on cyclotomic rings, so if distrust in cyclotomics was a good reason to reject Kyber, it would apply to NTRU too.
  - forty 4y ago
    My understanding is that he worked on NTRU Prime, which would have somehow benefited from NTRU being choosen.
code_biologist 4y ago
Here's the warning: Lattice-based cryptography is much more risky than commonly acknowledged. This applies, in particular, to lattice KEMs under consideration within the NIST Post-Quantum Cryptography Standardization Project (NISTPQC) as of October 2021. The above document... There's a linked PDF paper with more detail.

Obligatory djb warnings: https://ntruprime.cr.yp.to/warnings.html https://ntruprime.cr.yp.to/warnings.html

by dsp 4y ago

Obligatory djb warnings: https://ntruprime.cr.yp.to/warnings.html https://ntruprime.cr.yp.to/warnings.html

mixedmath 4y ago

What does "djb" mean here?

Retr0id 4y ago
https://en.wikipedia.org/wiki/Daniel_J._Bernstein https://en.wikipedia.org/wiki/Daniel_J._Bernstein

kzrdude 4y ago

Is djb involved in any of the standardized algorithms here by the way?

markschultz 4y ago
Yes, many. I believe he's on the SPHINCS+ team (was standardized), Classic McCliece (round 3, not standardized), and NTRU_PRIME (round 3, passed over for Kyber). Perhaps more, but he has significant skin in the game.

deleted 4y ago

[deleted]

0des 4y ago

should really be higher up.

bawolff 4y ago

Isn't that the point of having "hybrid" mode?

api 4y ago
HMAC(pqc_shared_secret, ecc_shared_secret)

forty 4y ago

What's the "obligatory djb warnings"? Something like "any crypto that's not mine isn't great"? ;)

sterlind 4y ago
from skimming it, his main argument is that Kyber relies on many constructions (e.g. cyclotomic polynomials) that are actively under attack - researchers have been successfully chipping away at them and show no signs of stopping. he also alleges that NIST have been moving the goal posts to favor Kyber, and they've been duplicitous in their narrative. he favors NTRU, which iirc isn't his.
- markschultz 4y ago
  Cyclotomic polynomials are incredibly standard in the field. The only researcher I know of who has issues with them is DJB, and there has not been significant advances in cryptanalysis due to usage of cyclotomics (with the exception of problems not used by NIST candidates, meaning the whole SOLIQUAY thing)
- mti 4y ago
  NTRU also relies on cyclotomic rings, so if distrust in cyclotomics was a good reason to reject Kyber, it would apply to NTRU too.
- forty 4y ago
  My understanding is that he worked on NTRU Prime, which would have somehow benefited from NTRU being choosen.

code_biologist 4y ago

Here's the warning: Lattice-based cryptography is much more risky than commonly acknowledged. This applies, in particular, to lattice KEMs under consideration within the NIST Post-Quantum Cryptography Standardization Project (NISTPQC) as of October 2021. The above document... There's a linked PDF paper with more detail.