Google announces new algorithm that makes FIDO encryption safe from quantum computers
New approach combines ECDSA with post-quantum algorithm called Dilithium.
As google hasnt given me any reason to trust them in the last decade I wont trust these news without independent 3rd party audit. A little fitting that its them who have one of the most advanced research done in quantum computing, after all..
This is the best summary I could come up with:
Like many existing security schemes today, though, FIDO faces an ominous if distant threat from quantum computing, which one day will cause the currently rock-solid cryptography the standard uses to completely crumble.
Over the past decade, mathematicians and engineers have scrambled to head off this cryptopocalypse with the advent of PQC—short for post-quantum cryptography—a class of encryption that uses algorithms resistant to quantum-computing attacks.
This week, researchers from Google announced the release of the first implementation of quantum-resistant encryption for use in the type of security keys that are the basic building blocks of FIDO2.
“While quantum attacks are still in the distant future, deploying cryptography at Internet scale is a massive undertaking which is why doing it as early as possible is vital,” Elie Bursztein and Fabian Kaczmarczyck, cybersecurity and AI research director, and software engineer, respectively, at Google wrote.
Moving forward, we are hoping to see this implementation (or a variant of it), being standardized as part of the FIDO2 key specification and supported by major web browsers so that users' credentials can be protected against quantum attacks.
The security of RSA and other traditional forms of asymmetric encryption is based on mathematical problems that are easy to verify the answer to but hard to calculate.
The original article contains 734 words, the summary contains 208 words. Saved 72%. I'm a bot and I'm open source!
Is FIDO Foss at all? I don't trust anything that isn't FOSS with my data?
They have the code for their open-source implementation of security keys here:
https://github.com/google/OpenSK
Their actual announcement post is here:
https://security.googleblog.com/2023/08/toward-quantum-resilient-security-keys.html
Google invents future, non-existent protection from future, non-existent threat. Will hackers find a future, non-existent flaw in this future, non-existent arms race?
Should we wait until encryption is completely broken before we start this research? Or should we start to study it now to figure out how to keep our privacy and security intact ahead of the threat?
Well, no-one stops you from just storing current Internet traffic and just waiting till quantum computers are a wide spread thing and then decrypting the traffic.