SLIDE 1 Crypto developments Daniel J. Bernstein Research Professor, University of Illinois at Chicago Hoogleraar, Cryptographic Implementations, Technische Universiteit Eindhoven A bit about me Designer of:
to handle Internet mail;
- tinydns, used by Facebook
to publish server addresses;
- dnscache, used by OpenDNS
to look up server addresses;
- Curve25519 public-key system
used by Apple to protect files stored on iPhones;
- ChaCha20 secret-key cipher
used by Chrome to encrypt HTTPS connections to Google.
SLIDE 2 developments
rch Professor, University of Illinois at Chicago
Cryptographic Implementations, echnische Universiteit Eindhoven A bit about me Designer of:
to handle Internet mail;
- tinydns, used by Facebook
to publish server addresses;
- dnscache, used by OpenDNS
to look up server addresses;
- Curve25519 public-key system
used by Apple to protect files stored on iPhones;
- ChaCha20 secret-key cipher
used by Chrome to encrypt HTTPS connections to Google. Standard Goals: p integrity,
SLIDE 3 developments Bernstein Professor, Illinois at Chicago Implementations, Universiteit Eindhoven A bit about me Designer of:
to handle Internet mail;
- tinydns, used by Facebook
to publish server addresses;
- dnscache, used by OpenDNS
to look up server addresses;
- Curve25519 public-key system
used by Apple to protect files stored on iPhones;
- ChaCha20 secret-key cipher
used by Chrome to encrypt HTTPS connections to Google. Standard crypto is Goals: protect confidentialit integrity, and availabilit
SLIDE 4 Chicago Implementations, Eindhoven A bit about me Designer of:
to handle Internet mail;
- tinydns, used by Facebook
to publish server addresses;
- dnscache, used by OpenDNS
to look up server addresses;
- Curve25519 public-key system
used by Apple to protect files stored on iPhones;
- ChaCha20 secret-key cipher
used by Chrome to encrypt HTTPS connections to Google. Standard crypto is failing Goals: protect confidentiality integrity, and availability.
SLIDE 5 A bit about me Designer of:
to handle Internet mail;
- tinydns, used by Facebook
to publish server addresses;
- dnscache, used by OpenDNS
to look up server addresses;
- Curve25519 public-key system
used by Apple to protect files stored on iPhones;
- ChaCha20 secret-key cipher
used by Chrome to encrypt HTTPS connections to Google. Standard crypto is failing Goals: protect confidentiality, integrity, and availability.
SLIDE 6 A bit about me Designer of:
to handle Internet mail;
- tinydns, used by Facebook
to publish server addresses;
- dnscache, used by OpenDNS
to look up server addresses;
- Curve25519 public-key system
used by Apple to protect files stored on iPhones;
- ChaCha20 secret-key cipher
used by Chrome to encrypt HTTPS connections to Google. Standard crypto is failing Goals: protect confidentiality, integrity, and availability. Standard crypto does a bad job
- f meeting these goals today,
and an even worse job tomorrow.
SLIDE 7 A bit about me Designer of:
to handle Internet mail;
- tinydns, used by Facebook
to publish server addresses;
- dnscache, used by OpenDNS
to look up server addresses;
- Curve25519 public-key system
used by Apple to protect files stored on iPhones;
- ChaCha20 secret-key cipher
used by Chrome to encrypt HTTPS connections to Google. Standard crypto is failing Goals: protect confidentiality, integrity, and availability. Standard crypto does a bad job
- f meeting these goals today,
and an even worse job tomorrow. The standardization process does not insist on security; ignores important warnings from cryptographers; ignores predictable improvements in computer technology; and is unable to resist attack.
SLIDE 8 about me Designer of: qmail, used by Yahoo handle Internet mail; tinydns, used by Facebook publish server addresses; dnscache, used by OpenDNS
Curve25519 public-key system by Apple to protect stored on iPhones; ChaCha20 secret-key cipher by Chrome to encrypt HTTPS connections to Google. Standard crypto is failing Goals: protect confidentiality, integrity, and availability. Standard crypto does a bad job
- f meeting these goals today,
and an even worse job tomorrow. The standardization process does not insist on security; ignores important warnings from cryptographers; ignores predictable improvements in computer technology; and is unable to resist attack. MD5 2008 Stevens–Sotirov– Appelbaum–Lenstra–Molna Osvik–de MD5 ⇒
SLIDE 9 y Yahoo ernet mail; by Facebook server addresses; used by OpenDNS server addresses; public-key system to protect iPhones; secret-key cipher Chrome to encrypt connections to Google. Standard crypto is failing Goals: protect confidentiality, integrity, and availability. Standard crypto does a bad job
- f meeting these goals today,
and an even worse job tomorrow. The standardization process does not insist on security; ignores important warnings from cryptographers; ignores predictable improvements in computer technology; and is unable to resist attack. MD5 2008 Stevens–Sotirov– Appelbaum–Lenstra–Molna Osvik–de Weger exploited MD5 ⇒ rogue CA
SLIDE 10
addresses; enDNS addresses; system rotect cipher rypt Google. Standard crypto is failing Goals: protect confidentiality, integrity, and availability. Standard crypto does a bad job
- f meeting these goals today,
and an even worse job tomorrow. The standardization process does not insist on security; ignores important warnings from cryptographers; ignores predictable improvements in computer technology; and is unable to resist attack. MD5 2008 Stevens–Sotirov– Appelbaum–Lenstra–Molnar– Osvik–de Weger exploited MD5 ⇒ rogue CA for TLS.
SLIDE 11 Standard crypto is failing Goals: protect confidentiality, integrity, and availability. Standard crypto does a bad job
- f meeting these goals today,
and an even worse job tomorrow. The standardization process does not insist on security; ignores important warnings from cryptographers; ignores predictable improvements in computer technology; and is unable to resist attack. MD5 2008 Stevens–Sotirov– Appelbaum–Lenstra–Molnar– Osvik–de Weger exploited MD5 ⇒ rogue CA for TLS.
SLIDE 12 Standard crypto is failing Goals: protect confidentiality, integrity, and availability. Standard crypto does a bad job
- f meeting these goals today,
and an even worse job tomorrow. The standardization process does not insist on security; ignores important warnings from cryptographers; ignores predictable improvements in computer technology; and is unable to resist attack. MD5 2008 Stevens–Sotirov– Appelbaum–Lenstra–Molnar– Osvik–de Weger exploited MD5 ⇒ rogue CA for TLS. 2012 Flame: new MD5 attack.
SLIDE 13 Standard crypto is failing Goals: protect confidentiality, integrity, and availability. Standard crypto does a bad job
- f meeting these goals today,
and an even worse job tomorrow. The standardization process does not insist on security; ignores important warnings from cryptographers; ignores predictable improvements in computer technology; and is unable to resist attack. MD5 2008 Stevens–Sotirov– Appelbaum–Lenstra–Molnar– Osvik–de Weger exploited MD5 ⇒ rogue CA for TLS. 2012 Flame: new MD5 attack. Fact: By 1996, a few years after the introduction of MD5, Preneel and Dobbertin were calling for MD5 to be scrapped.
SLIDE 14 Standard crypto is failing Goals: protect confidentiality, integrity, and availability. Standard crypto does a bad job
- f meeting these goals today,
and an even worse job tomorrow. The standardization process does not insist on security; ignores important warnings from cryptographers; ignores predictable improvements in computer technology; and is unable to resist attack. MD5 2008 Stevens–Sotirov– Appelbaum–Lenstra–Molnar– Osvik–de Weger exploited MD5 ⇒ rogue CA for TLS. 2012 Flame: new MD5 attack. Fact: By 1996, a few years after the introduction of MD5, Preneel and Dobbertin were calling for MD5 to be scrapped. Internet crypto standardization continued using MD5.
SLIDE 15
Standard crypto is failing protect confidentiality, integrity, and availability. Standard crypto does a bad job meeting these goals today, even worse job tomorrow. standardization process not insist on security; res important warnings cryptographers; res predictable improvements computer technology; and unable to resist attack. MD5 2008 Stevens–Sotirov– Appelbaum–Lenstra–Molnar– Osvik–de Weger exploited MD5 ⇒ rogue CA for TLS. 2012 Flame: new MD5 attack. Fact: By 1996, a few years after the introduction of MD5, Preneel and Dobbertin were calling for MD5 to be scrapped. Internet crypto standardization continued using MD5. Taiwan Citizen Renesas Security by T-Systems, CC assurance
SLIDE 16 is failing confidentiality, availability. does a bad job goals today, rse job tomorrow. rdization process
t warnings cryptographers; redictable improvements technology; and resist attack. MD5 2008 Stevens–Sotirov– Appelbaum–Lenstra–Molnar– Osvik–de Weger exploited MD5 ⇒ rogue CA for TLS. 2012 Flame: new MD5 attack. Fact: By 1996, a few years after the introduction of MD5, Preneel and Dobbertin were calling for MD5 to be scrapped. Internet crypto standardization continued using MD5. Taiwan Citizen Digital Renesas HD65145C1 Security Microcontroller”: by T-Systems, certified CC assurance level
SLIDE 17
confidentiality, bad job day, tomorrow. cess y; rnings rovements and MD5 2008 Stevens–Sotirov– Appelbaum–Lenstra–Molnar– Osvik–de Weger exploited MD5 ⇒ rogue CA for TLS. 2012 Flame: new MD5 attack. Fact: By 1996, a few years after the introduction of MD5, Preneel and Dobbertin were calling for MD5 to be scrapped. Internet crypto standardization continued using MD5. Taiwan Citizen Digital Certificates Renesas HD65145C1 “High- Security Microcontroller”: tested by T-Systems, certified by BSI CC assurance level EAL4+.
SLIDE 18
MD5 2008 Stevens–Sotirov– Appelbaum–Lenstra–Molnar– Osvik–de Weger exploited MD5 ⇒ rogue CA for TLS. 2012 Flame: new MD5 attack. Fact: By 1996, a few years after the introduction of MD5, Preneel and Dobbertin were calling for MD5 to be scrapped. Internet crypto standardization continued using MD5. Taiwan Citizen Digital Certificates Renesas HD65145C1 “High- Security Microcontroller”: tested by T-Systems, certified by BSI at CC assurance level EAL4+.
SLIDE 19
MD5 2008 Stevens–Sotirov– Appelbaum–Lenstra–Molnar– Osvik–de Weger exploited MD5 ⇒ rogue CA for TLS. 2012 Flame: new MD5 attack. Fact: By 1996, a few years after the introduction of MD5, Preneel and Dobbertin were calling for MD5 to be scrapped. Internet crypto standardization continued using MD5. Taiwan Citizen Digital Certificates Renesas HD65145C1 “High- Security Microcontroller”: tested by T-Systems, certified by BSI at CC assurance level EAL4+. Used in Chunghwa Telecom HICOS PKI Smart Card, tested by DOMUS IT Security Laboratory, FIPS 140-2 Level 2 certificate jointly from NIST and CSE.
SLIDE 20
MD5 2008 Stevens–Sotirov– Appelbaum–Lenstra–Molnar– Osvik–de Weger exploited MD5 ⇒ rogue CA for TLS. 2012 Flame: new MD5 attack. Fact: By 1996, a few years after the introduction of MD5, Preneel and Dobbertin were calling for MD5 to be scrapped. Internet crypto standardization continued using MD5. Taiwan Citizen Digital Certificates Renesas HD65145C1 “High- Security Microcontroller”: tested by T-Systems, certified by BSI at CC assurance level EAL4+. Used in Chunghwa Telecom HICOS PKI Smart Card, tested by DOMUS IT Security Laboratory, FIPS 140-2 Level 2 certificate jointly from NIST and CSE. Deployed for two million people.
SLIDE 21
MD5 2008 Stevens–Sotirov– Appelbaum–Lenstra–Molnar– Osvik–de Weger exploited MD5 ⇒ rogue CA for TLS. 2012 Flame: new MD5 attack. Fact: By 1996, a few years after the introduction of MD5, Preneel and Dobbertin were calling for MD5 to be scrapped. Internet crypto standardization continued using MD5. Taiwan Citizen Digital Certificates Renesas HD65145C1 “High- Security Microcontroller”: tested by T-Systems, certified by BSI at CC assurance level EAL4+. Used in Chunghwa Telecom HICOS PKI Smart Card, tested by DOMUS IT Security Laboratory, FIPS 140-2 Level 2 certificate jointly from NIST and CSE. Deployed for two million people. 2013 Bernstein–Chang–Cheng– Chou–Heninger–Lange–van Someren: 184 keys factored.
SLIDE 22
Stevens–Sotirov– elbaum–Lenstra–Molnar– Osvik–de Weger exploited ⇒ rogue CA for TLS. Flame: new MD5 attack. By 1996, a few years the introduction of MD5, Preneel and Dobbertin were for MD5 to be scrapped. Internet crypto standardization continued using MD5. Taiwan Citizen Digital Certificates Renesas HD65145C1 “High- Security Microcontroller”: tested by T-Systems, certified by BSI at CC assurance level EAL4+. Used in Chunghwa Telecom HICOS PKI Smart Card, tested by DOMUS IT Security Laboratory, FIPS 140-2 Level 2 certificate jointly from NIST and CSE. Deployed for two million people. 2013 Bernstein–Chang–Cheng– Chou–Heninger–Lange–van Someren: 184 keys factored. Dual EC 2004: ANSI random-numb (Didn’t sa secretly p
SLIDE 23
Stevens–Sotirov– elbaum–Lenstra–Molnar– exploited CA for TLS. new MD5 attack. a few years duction of MD5, Dobbertin were to be scrapped. standardization MD5. Taiwan Citizen Digital Certificates Renesas HD65145C1 “High- Security Microcontroller”: tested by T-Systems, certified by BSI at CC assurance level EAL4+. Used in Chunghwa Telecom HICOS PKI Smart Card, tested by DOMUS IT Security Laboratory, FIPS 140-2 Level 2 certificate jointly from NIST and CSE. Deployed for two million people. 2013 Bernstein–Chang–Cheng– Chou–Heninger–Lange–van Someren: 184 keys factored. Dual EC 2004: ANSI draft random-number generato (Didn’t say: design secretly predictable
SLIDE 24
elbaum–Lenstra–Molnar– TLS. attack. rs MD5, ere pped. rdization Taiwan Citizen Digital Certificates Renesas HD65145C1 “High- Security Microcontroller”: tested by T-Systems, certified by BSI at CC assurance level EAL4+. Used in Chunghwa Telecom HICOS PKI Smart Card, tested by DOMUS IT Security Laboratory, FIPS 140-2 Level 2 certificate jointly from NIST and CSE. Deployed for two million people. 2013 Bernstein–Chang–Cheng– Chou–Heninger–Lange–van Someren: 184 keys factored. Dual EC 2004: ANSI draft “Dual EC” random-number generator. (Didn’t say: designed by NSA, secretly predictable to NSA.)
SLIDE 25
Taiwan Citizen Digital Certificates Renesas HD65145C1 “High- Security Microcontroller”: tested by T-Systems, certified by BSI at CC assurance level EAL4+. Used in Chunghwa Telecom HICOS PKI Smart Card, tested by DOMUS IT Security Laboratory, FIPS 140-2 Level 2 certificate jointly from NIST and CSE. Deployed for two million people. 2013 Bernstein–Chang–Cheng– Chou–Heninger–Lange–van Someren: 184 keys factored. Dual EC 2004: ANSI draft “Dual EC” random-number generator. (Didn’t say: designed by NSA, secretly predictable to NSA.)
SLIDE 26
Taiwan Citizen Digital Certificates Renesas HD65145C1 “High- Security Microcontroller”: tested by T-Systems, certified by BSI at CC assurance level EAL4+. Used in Chunghwa Telecom HICOS PKI Smart Card, tested by DOMUS IT Security Laboratory, FIPS 140-2 Level 2 certificate jointly from NIST and CSE. Deployed for two million people. 2013 Bernstein–Chang–Cheng– Chou–Heninger–Lange–van Someren: 184 keys factored. Dual EC 2004: ANSI draft “Dual EC” random-number generator. (Didn’t say: designed by NSA, secretly predictable to NSA.) 2006 Gjøsteen: Dual EC is biased. 2006 Sidorenko–Schoenmakers: Dual EC is even more biased.
SLIDE 27
Taiwan Citizen Digital Certificates Renesas HD65145C1 “High- Security Microcontroller”: tested by T-Systems, certified by BSI at CC assurance level EAL4+. Used in Chunghwa Telecom HICOS PKI Smart Card, tested by DOMUS IT Security Laboratory, FIPS 140-2 Level 2 certificate jointly from NIST and CSE. Deployed for two million people. 2013 Bernstein–Chang–Cheng– Chou–Heninger–Lange–van Someren: 184 keys factored. Dual EC 2004: ANSI draft “Dual EC” random-number generator. (Didn’t say: designed by NSA, secretly predictable to NSA.) 2006 Gjøsteen: Dual EC is biased. 2006 Sidorenko–Schoenmakers: Dual EC is even more biased. NIST then standardized Dual EC.
SLIDE 28
Taiwan Citizen Digital Certificates Renesas HD65145C1 “High- Security Microcontroller”: tested by T-Systems, certified by BSI at CC assurance level EAL4+. Used in Chunghwa Telecom HICOS PKI Smart Card, tested by DOMUS IT Security Laboratory, FIPS 140-2 Level 2 certificate jointly from NIST and CSE. Deployed for two million people. 2013 Bernstein–Chang–Cheng– Chou–Heninger–Lange–van Someren: 184 keys factored. Dual EC 2004: ANSI draft “Dual EC” random-number generator. (Didn’t say: designed by NSA, secretly predictable to NSA.) 2006 Gjøsteen: Dual EC is biased. 2006 Sidorenko–Schoenmakers: Dual EC is even more biased. NIST then standardized Dual EC. 2007 Shumow–Ferguson: would have been easy to make Dual EC secretly predictable.
SLIDE 29
Taiwan Citizen Digital Certificates Renesas HD65145C1 “High- Security Microcontroller”: tested by T-Systems, certified by BSI at CC assurance level EAL4+. Used in Chunghwa Telecom HICOS PKI Smart Card, tested by DOMUS IT Security Laboratory, FIPS 140-2 Level 2 certificate jointly from NIST and CSE. Deployed for two million people. 2013 Bernstein–Chang–Cheng– Chou–Heninger–Lange–van Someren: 184 keys factored. Dual EC 2004: ANSI draft “Dual EC” random-number generator. (Didn’t say: designed by NSA, secretly predictable to NSA.) 2006 Gjøsteen: Dual EC is biased. 2006 Sidorenko–Schoenmakers: Dual EC is even more biased. NIST then standardized Dual EC. 2007 Shumow–Ferguson: would have been easy to make Dual EC secretly predictable. NIST kept standard until 2014.
SLIDE 30
an Citizen Digital Certificates Renesas HD65145C1 “High- Security Microcontroller”: tested T-Systems, certified by BSI at assurance level EAL4+. in Chunghwa Telecom PKI Smart Card, tested by DOMUS IT Security Laboratory, 140-2 Level 2 certificate from NIST and CSE. ed for two million people. Bernstein–Chang–Cheng– Chou–Heninger–Lange–van Someren: 184 keys factored. Dual EC 2004: ANSI draft “Dual EC” random-number generator. (Didn’t say: designed by NSA, secretly predictable to NSA.) 2006 Gjøsteen: Dual EC is biased. 2006 Sidorenko–Schoenmakers: Dual EC is even more biased. NIST then standardized Dual EC. 2007 Shumow–Ferguson: would have been easy to make Dual EC secretly predictable. NIST kept standard until 2014. Heartbleed Crypto standa rewards unnecessa
SLIDE 31
Digital Certificates 65145C1 “High- controller”: tested certified by BSI at level EAL4+. Chunghwa Telecom rt Card, tested by Security Laboratory, Level 2 certificate NIST and CSE. million people. Bernstein–Chang–Cheng– Chou–Heninger–Lange–van eys factored. Dual EC 2004: ANSI draft “Dual EC” random-number generator. (Didn’t say: designed by NSA, secretly predictable to NSA.) 2006 Gjøsteen: Dual EC is biased. 2006 Sidorenko–Schoenmakers: Dual EC is even more biased. NIST then standardized Dual EC. 2007 Shumow–Ferguson: would have been easy to make Dual EC secretly predictable. NIST kept standard until 2014. Heartbleed Crypto standardization rewards unnecessary
SLIDE 32
Certificates “High- tested BSI at EAL4+. elecom tested by ratory, certificate CSE. eople. Bernstein–Chang–Cheng– Chou–Heninger–Lange–van red. Dual EC 2004: ANSI draft “Dual EC” random-number generator. (Didn’t say: designed by NSA, secretly predictable to NSA.) 2006 Gjøsteen: Dual EC is biased. 2006 Sidorenko–Schoenmakers: Dual EC is even more biased. NIST then standardized Dual EC. 2007 Shumow–Ferguson: would have been easy to make Dual EC secretly predictable. NIST kept standard until 2014. Heartbleed Crypto standardization process rewards unnecessary complexit
SLIDE 33
Dual EC 2004: ANSI draft “Dual EC” random-number generator. (Didn’t say: designed by NSA, secretly predictable to NSA.) 2006 Gjøsteen: Dual EC is biased. 2006 Sidorenko–Schoenmakers: Dual EC is even more biased. NIST then standardized Dual EC. 2007 Shumow–Ferguson: would have been easy to make Dual EC secretly predictable. NIST kept standard until 2014. Heartbleed Crypto standardization process rewards unnecessary complexity.
SLIDE 34
Dual EC 2004: ANSI draft “Dual EC” random-number generator. (Didn’t say: designed by NSA, secretly predictable to NSA.) 2006 Gjøsteen: Dual EC is biased. 2006 Sidorenko–Schoenmakers: Dual EC is even more biased. NIST then standardized Dual EC. 2007 Shumow–Ferguson: would have been easy to make Dual EC secretly predictable. NIST kept standard until 2014. Heartbleed Crypto standardization process rewards unnecessary complexity. Exception: small platforms. But modern crypto platforms are complicated software devices.
SLIDE 35
Dual EC 2004: ANSI draft “Dual EC” random-number generator. (Didn’t say: designed by NSA, secretly predictable to NSA.) 2006 Gjøsteen: Dual EC is biased. 2006 Sidorenko–Schoenmakers: Dual EC is even more biased. NIST then standardized Dual EC. 2007 Shumow–Ferguson: would have been easy to make Dual EC secretly predictable. NIST kept standard until 2014. Heartbleed Crypto standardization process rewards unnecessary complexity. Exception: small platforms. But modern crypto platforms are complicated software devices. Complex crypto is practically impossible to get right and audit. Many security holes: Heartbleed, goto fail, new SChannel bug, etc.
SLIDE 36
Dual EC 2004: ANSI draft “Dual EC” random-number generator. (Didn’t say: designed by NSA, secretly predictable to NSA.) 2006 Gjøsteen: Dual EC is biased. 2006 Sidorenko–Schoenmakers: Dual EC is even more biased. NIST then standardized Dual EC. 2007 Shumow–Ferguson: would have been easy to make Dual EC secretly predictable. NIST kept standard until 2014. Heartbleed Crypto standardization process rewards unnecessary complexity. Exception: small platforms. But modern crypto platforms are complicated software devices. Complex crypto is practically impossible to get right and audit. Many security holes: Heartbleed, goto fail, new SChannel bug, etc. Crypto is front line, performance-constrained. Hard to isolate and monitor.
SLIDE 37
EC ANSI draft “Dual EC” random-number generator. (Didn’t say: designed by NSA, secretly predictable to NSA.) Gjøsteen: Dual EC is biased. Sidorenko–Schoenmakers: EC is even more biased. then standardized Dual EC. Shumow–Ferguson: have been easy to make EC secretly predictable. kept standard until 2014. Heartbleed Crypto standardization process rewards unnecessary complexity. Exception: small platforms. But modern crypto platforms are complicated software devices. Complex crypto is practically impossible to get right and audit. Many security holes: Heartbleed, goto fail, new SChannel bug, etc. Crypto is front line, performance-constrained. Hard to isolate and monitor. Quantum Attacker a large Sho RSA, DSA,
SLIDE 38 draft “Dual EC” generator. signed by NSA, redictable to NSA.) Dual EC is biased.
more biased. standardized Dual EC. erguson: easy to make predictable. standard until 2014. Heartbleed Crypto standardization process rewards unnecessary complexity. Exception: small platforms. But modern crypto platforms are complicated software devices. Complex crypto is practically impossible to get right and audit. Many security holes: Heartbleed, goto fail, new SChannel bug, etc. Crypto is front line, performance-constrained. Hard to isolate and monitor. Quantum computers Attacker equipped a large Shor computer RSA, DSA, ECDSA,
SLIDE 39
EC” r. NSA, NSA.) is biased. kers: biased. Dual EC. make redictable. 2014. Heartbleed Crypto standardization process rewards unnecessary complexity. Exception: small platforms. But modern crypto platforms are complicated software devices. Complex crypto is practically impossible to get right and audit. Many security holes: Heartbleed, goto fail, new SChannel bug, etc. Crypto is front line, performance-constrained. Hard to isolate and monitor. Quantum computers Attacker equipped with a large Shor computer breaks RSA, DSA, ECDSA, ECDH,
SLIDE 40
Heartbleed Crypto standardization process rewards unnecessary complexity. Exception: small platforms. But modern crypto platforms are complicated software devices. Complex crypto is practically impossible to get right and audit. Many security holes: Heartbleed, goto fail, new SChannel bug, etc. Crypto is front line, performance-constrained. Hard to isolate and monitor. Quantum computers Attacker equipped with a large Shor computer breaks RSA, DSA, ECDSA, ECDH, etc.
SLIDE 41
Heartbleed Crypto standardization process rewards unnecessary complexity. Exception: small platforms. But modern crypto platforms are complicated software devices. Complex crypto is practically impossible to get right and audit. Many security holes: Heartbleed, goto fail, new SChannel bug, etc. Crypto is front line, performance-constrained. Hard to isolate and monitor. Quantum computers Attacker equipped with a large Shor computer breaks RSA, DSA, ECDSA, ECDH, etc. Retroactively decrypts intercepted ciphertexts, whether or not they have “perfect forward secrecy”.
SLIDE 42
Heartbleed Crypto standardization process rewards unnecessary complexity. Exception: small platforms. But modern crypto platforms are complicated software devices. Complex crypto is practically impossible to get right and audit. Many security holes: Heartbleed, goto fail, new SChannel bug, etc. Crypto is front line, performance-constrained. Hard to isolate and monitor. Quantum computers Attacker equipped with a large Shor computer breaks RSA, DSA, ECDSA, ECDH, etc. Retroactively decrypts intercepted ciphertexts, whether or not they have “perfect forward secrecy”. No evidence that attackers have a Shor computer today. (D-Wave computer seems to be quantum but isn’t Shor.)
SLIDE 43
Heartbleed Crypto standardization process rewards unnecessary complexity. Exception: small platforms. But modern crypto platforms are complicated software devices. Complex crypto is practically impossible to get right and audit. Many security holes: Heartbleed, goto fail, new SChannel bug, etc. Crypto is front line, performance-constrained. Hard to isolate and monitor. Quantum computers Attacker equipped with a large Shor computer breaks RSA, DSA, ECDSA, ECDH, etc. Retroactively decrypts intercepted ciphertexts, whether or not they have “perfect forward secrecy”. No evidence that attackers have a Shor computer today. (D-Wave computer seems to be quantum but isn’t Shor.) My probability assessment: Medium probability by 2025. High probability by 2030.
