On Fri, Mar 31, 2017 at 10:20 PM, isis agora lovecruft isis@torproject.org wrote:
Hey hey,
In summary of the breakaway group we had last Saturday on post-quantum cryptography in Tor, there were a few potentially good ideas I wrote down, just in case they didn't make it into the meeting notes:
- A client should be able to configure "I require my entire circuit to have PQ handshakes" and "I require at least one handshake in my circuits to be PQ". (Previously, we had only considered having consensus parameters, in order to turn the feature on e.g. once 20% of relays supported the new handshake method.)
+1 on having something like this happen in some way, -0 on having client configuration be the recommended way for any purpose other than testing (Having clients behave differently is best avoided.)
Our usual approach for this kind of thing a consensus parameter that can be overridden with a local option.
- Using stateful hash-based signatures to sign descriptors and/or consensus documents, and (later) if state has been lost or compromised, then request the last such document submitted to regain state (probably skipping over all the leaves of the last used node in the tree, or the equivalent, to be safe). (This requires more concrete design analysis, including the effects of the large size of hash-based signatures on the directory bandwidth usage, probably in a proposal or longer write up, should someone awesome decides to research this idea further. :)
Interesting! I'd hope we do this as a separate proposal.
Also my hope is that in our timeline, we prioritize PQ encryption over authentication, since PQ encryption provides us forward secrecy against future quantum computers, whereas PQ authentication is only useful once a sufficient quantum computer exists.
(That's no reason not to think about PQ authentication, but with any luck, we can wait a few years for the PQ crypto world to invent some even better algorithms.)
peace,