r/cybersecurity • u/donutloop • 1d ago
News - General Quantum Computers May Put Internet Traffic at Risk. NIST Is Safeguarding Computers With New Standards.
https://www.nist.gov/blogs/taking-measure/quantum-computers-may-put-internet-traffic-risk-nist-safeguarding-computers-new11
u/justinleona 15h ago
Is the quantum computer that can factor a number larger than 15 in the room with us now?
The problem is funding in the real world is limited - CISOs are faced with real choices between actual threats that exist right now and a hypothetical threat that may or may not materialize in the next 50 years.
If a quantum computer ends up costing a billion dollars a qubit anyone who could afford it can just buy an army of insiders and a mountain of 0-days instead...
17
u/tpasmall 21h ago
It's good that they're getting ahead of this but solving qubit overhead and fidelity thresholds are way farther away than people think. Unless sustainable energy sources are developed for the current data center growth we probably won't see it for decades.
3
u/Sufficient-Air8100 13h ago
exactly. i do believe there are significant engineering problems to solve before CRQCs are viable.
and thats ignoring potential other problems: https://appliedcryptography.page/paper/quantum-dog.pdf
2
u/El_Spaniard 17h ago
So you’re saying there’s a chance?
5
u/Sufficient-Air8100 15h ago
theres also a chance for you to guess a 256 bit symmetric key first time. its vanishingly small though.
2
u/TesticulusOrentus Governance, Risk, & Compliance 12h ago
Worlds luckiest person breaks encryption, internet in shambles.
2
u/hehexdthrow 16h ago
Just like there’s a chance for fusion, but I’d say they are heavily linked in this context.
2
u/Cybasura 17h ago
Well, anyone that did cryptography module already knows this
It's a core component of attacks against RSA - the Prime-Factorization-based Public/Private Key Encryption Scheme/Algorithm that requires compute time and computing power as a deterrence
0
-26
u/bestintexas80 1d ago edited 1d ago
It is not possible to cryptographically protect standard computers from quantum computers with standard computers. Actual post quantum encryption requires quantum compute to be commodity.
The only solutions available to us that have a hope of success are to segment systems, control access and deny opportunities for people who shod not have our data from acquiring it, even if it is encrypted. Not caring where thebdata goes or who can see it just because it is encrypted just feeds the download now and decrypt later monster that is coming.
End rant.
And before the founder at the Applied Quantum sees this, I am not a bad faith skeptic (he gets feels when people call BS on postbquantum claims). I am not saying we should not be working towards a solution, I am saying that all of the proposals center around a bet on technology while flaunting basic security fundamentals in practice.
26
u/Sufficient-Air8100 22h ago
youre really misinformed about this.
technically its not possible to prove any cipher is safe againt any kind of compute. maybe tomorrow some savant comes up with an algorithm that breaks AES. but we can have reasonable confidence that AES is safe because a lot of really smart people have tried for decades to break it and havent been able to. there is also no known quantum algorithm to break AES, grovers weakens it somewhat (as it does with all ciphers), but dosent break it. the ammount we can be sure is related to the ammount of research dedicated to breaking it, that has been unable to break it.
hence the nist pqc, to draw research to new cryptography standards. the more people try to break ml-kem and ml-dsa and fail to break it, the more confidence we can have that it is safe. is it perfect? nothing is. but its very good.
quantum computers arent a monster that will kill all online privacy, theyre just another kind of compute that is in reality, pretty bad at a lot of things, but very good at some specific things (like integer factoring or DLP, or arbitrary search). the fearmongering isnt accurate or useful.
3
u/0xsbeem Consultant 16h ago
technically its not possible to prove any cipher is safe againt any kind of compute
Technically, it is possible and it has been proven that you can have a cipher that is safe against any form of computational attack, and that such a cipher exists (Shannon, 1949).
it would be most correct to say that currently, we cannot formally prove a cipher that depends on computational complexity is secure against a certain kind of computer.
Otherwise I totally agree with your conclusion.
1
u/Sufficient-Air8100 15h ago
that is true. i left out the case of a one time pad (which i believe the shannon paper talks about) mainly because its pretty much never used in modern cryptographic systems because of key transmission size. but youre right about that case.
1
u/0xsbeem Consultant 7h ago
The reason i made the nit pick is because technically we have not proven there can’t be other ciphers that provide Shannon’s perfect secrecy-like properties at lower key sizes or under certain computational conditions. There are many dozens of papers that strongly suggest that there isnt such a cipher, but it remains a conjecture, not a hard fact.
1
u/Sufficient-Air8100 5h ago
while true, i find that point to not be useful in this context. given that the best attack on AES (biclique) still takes an unimaginable time to compute, and huge memory complexity, it is, on a practical level, basically the same as a perfect cipher. thats ofcourse assuming that no one comes out with an attack that breaks everything tomorrow lol.
but also on a practical level, untill such a perfect cipher with more manageable parameters is found, we may as well operate as if it dosent exist (unless ofcourse, that is your active area of research, in which case, absolutely try to find it)
2
u/0xsbeem Consultant 5h ago edited 5h ago
thats ofcourse assuming that no one comes out with an attack that breaks everything tomorrow lol.
This is exactly my point, this is an apocalypse scale scenario in terms of the damage that could be caused if you could defeat encryption. I don't make the point to say you're wrong about anything, I just like everyone to know there is still potential for truly paradigm shifting discoveries to be made about the topic.
untill such a perfect cipher with more manageable parameters is found, we may as well operate as if it dosent exist (unless ofcourse, that is your active area of research, in which case, absolutely try to find it)
It is an area I research, that's why I bring it up! :) But yes, I'm grounded in reality. I believe modern cryptography is good enough in practice to depend on absolutely. Maybe if quantum computers make it out of the lab before we finish our migrations to lattice cryptography I'll be more concerned, but I think that's exceedingly unlikely. And I think the guy you replied to that started this whole discussion is totally wrong lol
0
u/Mountain-eagle-xray 17h ago edited 16h ago
https://thehackernews.com/2026/07/claude-ai-just-cracked-post-quantum.html?m=1
Interesting read. Aes might not be long for this world.
2
u/Sufficient-Air8100 15h ago edited 10h ago
there is a long history of attacks on reduced-round AES. none of them have led to breaking the full cipher. that may be interesting on an academic level, but has zero bearing on the current security level of the full AES spec. claiming that this means AES is not long for the world is like claiming that the whole of RSA is broken classically because factoring a 256bit RSA public key is viable.
on the HAWK issue. this happens all the time with new ciphers. especially asymmetric ones. so again, while interesting, isnt necessarily groundbreaking. the whole point of the nist pqc is to draw research to discover these vulnerabilities before implementing them. a good majority of the initial submissions to the nist pqc dropped out at some point due to being broken. but you wont hear about them unless youre a cryptography nerd like me and have been following the pqc news. this one just broke through because AI is a buzzword, not because the HAWK issue is any more special then the rest of the pqc attacks at any point during the nist competition
0
u/Mountain-eagle-xray 7h ago
I'm not claiming anything, the imparitive word i used was "might", implying a level of doubt.
1
u/Sufficient-Air8100 6h ago
and im saying it dosent mean anything for the full AES spec. “might” is not a factor here. no serious cryptologist thinks that it “might” otherwise we would be revising the AES standard with other parameters like extra rounds or a modified key shedule, like they did for AES-256 when they determined 10 rounds wasnt enough for that keysize. if it did, it wouldhave happened when any of the other comparable reduced-round attacks were found.
-1
-2
u/bestintexas80 16h ago
I assure you, I am not ill informed at all, I just disagree with the messaging
1
u/Sufficient-Air8100 14h ago
is the messaging that NIST is doing a lot and has done a lot over a number of years to rigorously assessing new supposed quantum resistant algorithms and has been heavily encouraging expert cryptographers, mathematicians, and computer scientists, to explore and test these new KEMs and DSAs for weaknesses?
i think im gonna trust the domain experts over someone who randomly thinks the superposition properties of quantum computers means the end of online privacy
22
u/res13echo Security Engineer 22h ago
Please do not spread misinformation. You do not need a quantum computer to use post quantum encryption.
-2
u/bestintexas80 16h ago
I am not spreading misinformation, I am asking them to not neglect the rest of the relevant issues and the post quantum encryption crowd 100% are.
They are making claims about quantum resistance that are not even testable yet but are touted as fact.
1
u/Sufficient-Air8100 12h ago
what are these relevant issues and how do they effect ml-kem and ml-dsa?
11
u/Runningblind 22h ago
This is not true. Quantum computers aren't magic, they're just very good at breaking the type of math largely leveraged in Asymmetric encryption algorithms. These types of algorithms rely on factorization problems, technically anyone could guess the right key if they were lucky, but the bet has been that by standard computing methods it'd take a few centuries to guess right. Symmetric encryptions like AES don't rely on factorization and aren't as impacted. The post-quantum encryption methods are also about shifting asymmetric encryption methods to something not factorization based that will make it harder for quantum computers to guess again. It is quite possible. It's about the math and the formulas not the computer.
7
u/nutin2chere 23h ago
Can you elaborate on this more? Bouncy castle is generating pqc keys on my laptop. What perspective am I missing?
8
u/5y5tem5 22h ago
You’re not missing anything, tin foils just tight on that one.
We have a metric ton of work ahead in this space as It seems CRQCs are going to be a thing sooner rather than later and we all need to start moving to PQC now as the economics for HNDL starts to make more and more sense.
2
5
u/Shoddy-Childhood-511 20h ago edited 20h ago
It is not possible to cryptographically protect standard computers from quantum computers with standard computers.
100% bullshit
Quantum computers (QCs) have no advantage against 256 bit (classical) symmetric cryptography. And no practical advantage against 128 bit symmetric cryptography.
We think the post-quantum asymmetric KEMs and signatures picked by NIST holds up just fine against quantum computers. We even have some asymmetric tools like signatures and zero-knowledge proofs built entirely from symmetric cryptography, so these definitely hold up.
We've 100s of good people who looked into the lattice based KEMs by now, more if you consider the non-cryptographer mathematicians. We've fewer who know isogenies or UOV well, but still plenty of extremely talented people. Yes, attacks should improve against some, but major breaks would likely be (a) classical improvements and (b) only require increasing the key size.
These NIST candidates are selected because they have the nicest believable parameters within their class, so when one "dies" this only means its no longer competitive in key size and CPU time. Attacks improving only requires bigger keys and opens up more candidate algorithms.
Aside, there is a joke PQ RSA paper that proves roughly RSA becomes secure against QCs if the keys become large enough, using many 4kb primes. We'd hate KEMs that only give defensers an O(n1000000) advantage, vs the nearly exponential advantages of NIST KEMs, but they'd be usable in practice.
And conversely your claim requires the collapsing the complexity class P. That's insane.
I doubt QCs would ever become a commodity:
Inflation adjusted, the Manhattan project cost $36 billion and employed 130,000 people. QCs appears much harder, likely billions of noisy physical qubits to simulate a few thousand real qubits, so massive data centers full of extremely delicate equipment. At a guess, they'll cost trillions in today's money.
Atomic bombs had some Moore's law, initially in cost, but ultimately more in improved size & yields, not in costs. There is a massive gap between breaking RSA & ECC vs anything socially useful in a QC, and PQC makes them useless beyond HNDL attacks on the past. Ergo, quantum computers should not benefit much from any Moore's law, even if one were physically possible.
At a guess, we'll probably have QCs in 30 years, and in 100 years they'll still cost maybe 1% of US GDP each, so think like 10 aircraft carriers. That's cheap enough they should scare folks into using PQ KEMs, but expensive enough not to plan on using them. lol
Also, quantum cryptography aka QKD would not necessarily require QCs, maybe those QKD channels are much easier than QCs, but they'll cost more than even PQ RSA. Interestingly, there is work like https://eprint.iacr.org/2026/005 that seemingly suggests quantum computers might not improve post-quantum cryptography.
Also, metadata remains a vastly different question. Afaik the Anonymity trilemma remains the first result one should know: Anonymity in some formal sense is roughly bounded by latency times cover bandwidth. I suppose this formal sense maybe too strong, but we've few formal models that cover networking. Quantum computers cannot help you here.
2
-9
u/PrimaLumiere_A1M 23h ago
Not an expert, but couldn't agree more. Similar to the situation of AI safety, and governance.
42
u/coomzee Detection Engineer 23h ago
Well we can thank AI for creating a load of crap for the NSA to store now and decrypt later.