Send tor-dev mailing list submissions to
 tor-dev@lists.torproject.org

To subscribe or unsubscribe via the World Wide Web, visit
 https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-dev
or, via email, send a message with subject or body 'help' to
 tor-dev-request@lists.torproject.org

You can reach the person managing the list at
 tor-dev-owner@lists.torproject.org

When replying, please edit your Subject line so it is more specific
than "Re: Contents of tor-dev digest..."

Today's Topics:

   1. Re: Quantum-safe Hybrid handshake for Tor (Ryan Carboni)
   2. Re: Quantum-safe Hybrid handshake for Tor (Yawning Angel)

Message: 1
Date: Fri, 1 Jan 2016 19:33:31 -0800
From: Ryan Carboni <ryacko@gmail.com>
To: tor-dev@lists.torproject.org
Subject: Re: [tor-dev] Quantum-safe Hybrid handshake for Tor
Message-ID:
 <CAO7N=i2MspE1N5eOczCyT9RCPORgUJboSOY3vUMGKL5FSzAPnw@mail.gmail.com>
Content-Type: text/plain; charset="utf-8"

The first step should be replacing the long-term keys with quantum-safe
crypto.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.torproject.org/pipermail/tor-dev/attachments/20160101/14b4bd21/attachment-0001.html>

Message: 2
Date: Sat, 2 Jan 2016 04:19:28 +0000
From: Yawning Angel <yawning@schwanenlied.me>
To: tor-dev@lists.torproject.org
Subject: Re: [tor-dev] Quantum-safe Hybrid handshake for Tor
Message-ID: <20160102041928.15e0cbc3@schwanenlied.me>
Content-Type: text/plain; charset="us-ascii"

On Fri, 1 Jan
2016 19:33:31 -0800
Ryan Carboni <ryacko@gmail.com> wrote:

 The first step should be replacing the long-term keys with
 quantum-safe crypto.

Wrong.

There are NO usable PQ signature primitives that are suitable for
deployment.  Adding 1408+ bytes to every single microdescriptor is
not a realistic proposition.  Signing is also quite expensive unless you
have AVX2, and will decimate circuit build performance.

Protecting against Quantum Computer equipped active Man-In-The-Middle
attacks is the least important thing to do in terms of user safety.

By modifying the link handshake to incorporate a PQ key exchange
algorithm with ephemeral keys as in the proposal, user data being
generated right now will be protected from bulk decryption later, in
the event of
a Curve25519 break (probably by a large enough Quantum
Computer), which is a far more realistic threat to be concerned about.