@Daniel J. Bernstein
Designing cryptography (deployed now: X25519, Ed25519, ChaCha20, sntrup, Classic McEliece) to proactively reduce risks. Coined phrase "post-quantum" in 2003.
Relays (1)
- wss://relay.ditto.pub – read & write
Recent Notes
Now wondering what happens to the claw-finding inside https://eprint.iacr.org/2026/1486 if the internal degrees are allowed to go up to, say, p^(1/5) instead of p^(1/6). Bigger space to work with is nicer for vOW; are there many more collisions, as in subset-sum algorithms from HGJ etc.?
Here's a script using our PQCrypto 2008 software to decode the 2^255 size from tii_decoding_challenge in <1 sec on 1 core: https://cr.yp.to/2026/20260722-break-fake-mceliece-sizes-from-tii.sh When TII announced its fake sizes in 2023, I said they had omitted "one of the central defenses in McEliece": https://web.archive.org/web/20260616122115/https://groups.google.com/a/list.nist.gov/g/pqc-forum/c/KzmgtZ3qBME/m/LTiMRSnKAQAJ
nostr:nprofile1qy2hwumn8ghj7un9d3shjtnyd968gmewwp6kyqpq97qqqj2gfydepp0prr33atwsvr06u2gvymd6ek5vrcypwwh92f7q8dy6rq do i understand right that because of the patent license mess, the eu can't just speci...
@nprofile1q... I'm not aware of any way that the patent mess for ML-KEM would be triggered specifically by using ECC+ML-KEM. Cloudflare already reports that it sees 70% of its incoming HTTPS connections using ECC+ML-KEM. NSA is waving a ton of money around (see https://blog.cr.yp.to/20251004-weakened.html#tls) for companies to remove ECC from that, first as an option in standards and then in production.
Wow. After disenfranchising an unspecified list of people and making claims about the resulting numbers, the IETF TLS WG chairs refused to answer an evidence request from Fabiana Da Pieve, the European Commission's Team Leader Post-Quantum Cryptography: https://web.archive.org/web/20260721143439/https://mailarchive.ietf.org/arch/msg/tls/RLDcZHHbCUZRgmmWbP1j2dDQhAQ/
2
Can we get the IETF TLS WG chairs to help out with the U.S. elections? Allow votes only from pre-existing landowners plus the list of people who the chairs declare have demonstrated enough expertise to vote? Also, make sure to hide that list: https://web.archive.org/web/20260719121145/https://mailarchive.ietf.org/arch/msg/tls/tPe7m_vpmDco43588yVW3JWrb8U/
"IETF participation is free and open to all interested individuals. ... Decision-making requires achieving broad consensus via these public processes." (https://web.archive.org/web/20260703153542/https://www.ietf.org/blog/ietf-llc-statement-competition-law-issues/). Reality: pay-to-play; NSA casts 6 votes; NSA pays its vendors to vote; chairs throw away _your_ vote.
IETF TLS WG chairs have arrogated to themselves the power to disenfranchise all except "pre-existing WG participants" + people who the chairs say have "demonstrated expertise": https://web.archive.org/web/20260719121145/https://mailarchive.ietf.org/arch/msg/tls/tPe7m_vpmDco43588yVW3JWrb8U/ They say: gives 7/10 in favor; "rough consensus". RFC will claim "consensus".
@nprofile1q... https://cr.yp.to/papers/mldsa-20260601.pdf#breakable-keys is a graph estimating the number of breakable keys each year for Ed25519, ML-DSA-44, and the Ed25519+ML-DSA-44 combination. That's for signatures but the KEM situation is similarly scary. No idea where you're getting the idea that we aren't worried about the combined risk; we're fighting multiple fires at once here.
Wait, I undercounted: NSA cast _six_ votes (Mike Jenkins, Nicholas Gajcowski, William Layton, Morgan Stern, Peter Yee from non-NSA address, Mark Motley from non-NSA address). Looking beyond NSA: DoD's Ann Krieger; DoD lifer Major Mike StJohns. Three GCHQ, two CSE, one partridge.
IETF TLS WG chairs have closed the vote, and say they'll go through https://mailarchive.ietf.org/arch/browse/tls/ "to see what the consensus is". Consensus? Each side received more than 80 votes on list: e.g., 7 positive votes from DoD, 4 from Cisco, etc. (5 on each side didn't give full real names.)
1
In my sysadmin hat, I'm puzzled by the "now that you've upgraded your kernel, restore rxrpc etc." parts of some online guides. If system works with, e.g., ptrace_scope=2 and userns_clone=0 and without act_pedit ah4 ah6 algif_aead cifs esp4 esp6 rds rxrpc, why turn those back on?