16
A Cryptography Engineer’s Perspective on Quantum Computing Timelines
(words.filippo.io)
a community for posting cool tech news you don’t want to sneer at
non-awfulness of tech is not required or else we wouldn’t have any posts
I think the main difference here is that breaking RSA now just requires scaling up existing approaches, while breaking LWE or anything like that would need a major conceptual breakthrough. The former possibility is much more likely, and in any case, cryptographers are the most paranoid people on the planet for a reason.
Unfortunately, one can never be sure about much in cryptography until P vs NP is solved (and then some).
(Of course, just because some people say that scaling up is enough doesn't mean it's actually true. For breaking RSA, we know have Shor's algorithm, while the only evidence AI bros have from superintelligence coming from scaling is "trust me bro".)
Yeah and I agree that in principle we should be trying to move to cryptosystems which aren't known to be broken by quantum algorithms. I just don't think the argument in the article is sound. There are costs, including actual security risks, inherent to switching. To name a couple:
You have to actually weigh the benefits of resistance to quantum computers (which may or may not actually appear) against these costs (which certainly will). Paranoia isn't a threat model.
And to be clear cryptographers already know these things and if they still think we should all move to lattice cryptosystems despite the costs then that's totally fine. I just wish they would write their blog posts to reflect that instead of talking about the 1% thing.