[tor-dev] [prop269] [prop270] Ideas from Tor Meeting Discussion on Post-Quantum Crypto

[Nick Mathewson]

On Fri, Mar 31, 2017 at 10:20 PM, isis agora lovecruft
<isis at torproject.org> wrote:
> Hey hey,
>
> In summary of the breakaway group we had last Saturday on post-quantum
> cryptography in Tor, there were a few potentially good ideas I wrote down,
> just in case they didn't make it into the meeting notes:
>
>  * A client should be able to configure "I require my entire circuit to have
>    PQ handshakes" and "I require at least one handshake in my circuits to be
>    PQ".  (Previously, we had only considered having consensus parameters, in
>    order to turn the feature on e.g. once 20% of relays supported the new
>    handshake method.)

+1 on having something like this happen in some way, -0 on having
client configuration be the recommended way for any purpose other than
testing (Having clients behave differently is best avoided.)

Our usual approach for this kind of thing a consensus parameter that
can be overridden with a local option.


>  * Using stateful hash-based signatures to sign descriptors and/or consensus
>    documents, and (later) if state has been lost or compromised, then request
>    the last such document submitted to regain state (probably skipping over
>    all the leaves of the last used node in the tree, or the equivalent, to be
>    safe).  (This requires more concrete design analysis, including the effects
>    of the large size of hash-based signatures on the directory bandwidth
>    usage, probably in a proposal or longer write up, should someone awesome
>    decides to research this idea further. :)

Interesting!  I'd hope we do this as a separate proposal.

Also my hope is that in our timeline, we prioritize PQ encryption over
authentication, since PQ encryption provides us forward secrecy
against future quantum computers, whereas PQ authentication is only
useful once a sufficient quantum computer exists.

(That's no reason not to think about PQ authentication, but with any
luck, we can wait a few years for the PQ crypto world to invent some
even better algorithms.)

peace,
-- 
Nick