Cryptography If quantum computing development would speed up or some entity would be found to be close to critical ECDSA breaking level, could organisations switch to post quantum cryptography fast?

---

If quantum computing development would speed up or some entity would be found to be close to critical ECDSA breaking level, could organisations switch to post quantum cryptography fast? Posted: 23 Nov 2018 06:59 AM PST Besides IBM, Google Microsoft, Rigetti, Intel etc, there is CIA, China, Russia, who develop in secret and they don't always have the best intentions towards each other obviously. Would be kind of a black swan event if a hack would be discovered somewhere. NSA been advising to look ahead since 2015, so I can imagine organisations with lots at stake are already busy having some plan ready. Would banks for example have started to develop implement-ready plans to make the switch? E-mail servers stock exchanges etc. submitted by /u/Dezeyay [link] [comments]

recommended hashes for various SECG curves Posted: 23 Nov 2018 08:47 AM PST https://crypto.stackexchange.com/a/62775 says "It shall be noted that FIPS 186-4 and ANSI X9.62 recommend using with each curve a hash function with a somewhat "matching" strength. NIST defines 15 curves: for each of five formal "strengths" (80, 112, 128, 192 and 256 bits), the recommended hash function has output length exactly twice the strength, and there are three standard NIST curves whose subgroup order length is at least twice the strength" I may have skimmed through https://nvlpubs.nist.gov/nistpubs/fips/nist.fips.186-4.pdf too quickly but I didn't see anything about recommended hashes. The smallest prime field curve FIPS 186-4 mentions appears to be P-192 but the stackexchange length mentions a "strength" of 80. I guess he's referring to the key size chart at https://www.globalsign.com/en/blog/elliptic-curve-cryptography/ wherein the elliptic curve length divided by two is equal to the equivalent symmetric key size. 192 isn't in that table but 192 / 2 is 96 so double that (since the "recommended hash function has output length exactly twice the strength") would be 192. There's not a SHA-192, however, so maybe SHA-224 would be the best one to use? submitted by /u/kemmeta [link] [comments]

You are subscribed to email updates from Cryptography news and discussions. To stop receiving these emails, you may unsubscribe now.	Email delivery powered by Google
Google, 1600 Amphitheatre Parkway, Mountain View, CA 94043, United States