<html><head><meta http-equiv="Content-Type" content="text/html charset=us-ascii"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;"><div>Thanks Dan!</div><div><br><blockquote type="cite">One exception is SPHINCS (<a href="http://sphincs.cr.yp.to">http://sphincs.cr.yp.to</a>): we explicitly<br>targeted a 2^128 post-quantum security level. We're encouraging people<br>to do this type of analysis and parameter selection for more systems.<br></blockquote></div><div><br></div><div>Does SPHINCS also allow for encryption, or is it for generating secure signatures only?</div><div><br></div><div>Have you any comments about SIDH btw? According to this, it claims to provide forward secrecy:</div><div><br></div><div><a href="https://en.wikipedia.org/wiki/Supersingular_Isogeny_Key_Exchange">https://en.wikipedia.org/wiki/Supersingular_Isogeny_Key_Exchange</a></div><div><br></div><div>BTW, I smiled and lol'd at:</div><div><br></div><blockquote style="margin: 0 0 0 40px; border: none; padding: 0px;"><b>Special note to law-enforcement agents:</b>
The word "state" is a technical term in cryptography.
Typical hash-based signature schemes need to record information,
called "state", after every signature.
Google's Adam Langley refers to this as a
<a href="https://www.imperialviolet.org/2013/07/18/hashsig.html">"huge foot-cannon"</a>
from a security perspective.
By saying "eliminate the state" we are advocating a security improvement,
namely adopting signature schemes
that do not need to record information after every signature.
We are not talking about eliminating other types of states.
We love most states, especially yours!
Also, "hash" is another technical term and has nothing to do with cannabis. </blockquote><div><br></div><div apple-content-edited="true">
:-)</div><div apple-content-edited="true"><br></div><div apple-content-edited="true">- Greg</div><div apple-content-edited="true"><br class="Apple-interchange-newline"><span style="color: rgb(0, 0, 0); font-family: Helvetica; font-size: 14px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; display: inline !important; float: none;">--</span><br style="color: rgb(0, 0, 0); font-family: Helvetica; font-size: 14px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px;"><span style="color: rgb(0, 0, 0); font-family: Helvetica; font-size: 14px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; display: inline !important; float: none;">Please do not email me anything that you are not comfortable also sharing</span><span style="color: rgb(0, 0, 0); font-family: Helvetica; font-size: 14px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; display: inline !important; float: none;"> with the NSA.</span>
</div>
<br><div><div>On Jan 24, 2015, at 9:06 PM, D. J. Bernstein <<a href="mailto:djb@cr.yp.to">djb@cr.yp.to</a>> wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite">Two comments on terminology.<br><br>1. "Forward secrecy" (especially "perfect forward secrecy") frequently<br>deceives users into thinking that their communication is protected<br>against future cryptanalytic advances, notably quantum computers.<br><br>In the MinimaLT paper we switched terminology from "forward secrecy" to<br>"key erasure". Erasing keys clearly does nothing against cryptanalysis:<br>at best it stops someone who steals your notes of the keys. This phrase<br>also allows easy quantification: e.g., "key erasure after a minute" or<br>"key erasure as soon as the next message is received".<br><br>2. When people say that a "post-quantum" system "has 2^128 security",<br>what they typically mean is that the system<br><br> * has 2^128 security against known _pre-quantum_ attacks and<br> * retains _some_ security against post-quantum attacks,<br><br>but it's rare for the _post-quantum security level_ to be quantified.<br>It's reasonable to expect Grover-type attacks to break most of these<br>systems with far fewer quantum operations, maybe as few as 2^64, which<br>isn't good enough for long-term security.<br><br>One exception is SPHINCS (<a href="http://sphincs.cr.yp.to">http://sphincs.cr.yp.to</a>): we explicitly<br>targeted a 2^128 post-quantum security level. We're encouraging people<br>to do this type of analysis and parameter selection for more systems.<br><br>---Dan<br>_______________________________________________<br>Messaging mailing list<br><a href="mailto:Messaging@moderncrypto.org">Messaging@moderncrypto.org</a><br>https://moderncrypto.org/mailman/listinfo/messaging<br></blockquote></div><br></body></html>