Post

Pingoo
@pingoo.io

@filippo.abyssdomain.expert I agree to disagree: 128-bit keys MUST BE upgraded during a post-quantum migration. kerkour.com/128-bit-keys...

kerkour.comAre 128-bit symmetric keys really secure against quantum computers?Quantum computers are a threat to traditional cryptography, more specifically to asymmetric cryptography (signatures and key exchanges) with Shor's algorithm enabling fast factoring of big numbers.
Filippo Valsorda@filippo.abyssdomain.expert

There are no technical or compliance reasons to double the size of symmetric keys in response to the threat of quantum computers. This common misunderstanding of Grover's algorithm risks wasting limited resources that should go towards deploying actually urgent post-quantum algorithms.

words.filippo.ioQuantum Computers Are Not a Threat to 128-bit Symmetric KeysThere is no need to update symmetric key sizes as part of the post-quantum transition, due to the details of how Grover's algorithm scales. Most authorities agree.

0 reposts1 like

Filippo Valsorda
@filippo.abyssdomain.expert

None of those arguments seem to have anything to do with quantum computers. If you have a preference for 256-bit keys, you're welcome to it, but it's not about the PQ migration. (Also, your benchmarks have AES-256-GCM faster than AES-128-GCM on amd64 Go. I am certain that's not accurate.)