Australia Moves To Drop Some Cryptography By 2030 (theregister.com) 23
An anonymous reader shares a report: Australia's chief cyber security agency has decided local orgs should stop using the tech that forms the current cryptographic foundation of the internet by the year 2030 -- years before other nations plan to do so -- over fears that advances in quantum computing could render it insecure.
The Land Down Under's plans emerged last week when the Australian Signals Directorate (ASD) published guidance for High Assurance Cryptographic Equipment (HACE) -- devices that send and/or receive sensitive information -- that calls for disallowing the cryptographic algorithms SHA-256, RSA, ECDSA and ECDH, among others, by the end of this decade.
Bill Buchanan, professor in the School of Computing at Edinburgh Napier University, wrote a blog post in which he expressed shock that the ASD aims to move so quickly. "Basically, these four methods are used for virtually every web connection that we create, and where ECDH is used for the key exchange, ECDSA or RSA is used to authenticate the remote server, and SHA-256 is used for the integrity of the data sent," he wrote. "The removal of SHA-256 definitely goes against current recommendations."
The Land Down Under's plans emerged last week when the Australian Signals Directorate (ASD) published guidance for High Assurance Cryptographic Equipment (HACE) -- devices that send and/or receive sensitive information -- that calls for disallowing the cryptographic algorithms SHA-256, RSA, ECDSA and ECDH, among others, by the end of this decade.
Bill Buchanan, professor in the School of Computing at Edinburgh Napier University, wrote a blog post in which he expressed shock that the ASD aims to move so quickly. "Basically, these four methods are used for virtually every web connection that we create, and where ECDH is used for the key exchange, ECDSA or RSA is used to authenticate the remote server, and SHA-256 is used for the integrity of the data sent," he wrote. "The removal of SHA-256 definitely goes against current recommendations."
Re: (Score:2)
oH. That's a lot of money. Maybe I won't crack ALL of you. Just
Cascade like TrueCrypt/VeraCrypt? (Score:2)
Sometimes, I wonder if we should consider algorithm cascades. No, unlike the novice belief that two 256 algorithms will give 512 bits of security, (at best, they give 257 bits), this is intended to deal with an algorithm being completely broken. For example, if we did RSA, ED-25519, and Khyber, or ED25519, Khyber and SPINCS/XMSS, algorithms that use hashes and lattices, as well as a good old factoring standard, we should have solid protection via conventional attacks, as well as quantum attacks.
Or more si
are there alternatives that will actually work? (Score:2)
I'm all for replacing these 4 with more resistant algorithms... but are there any that are viable?
When we started swapping out for Elypticals... we ran into a host of issues with implementations and hardware performance issues.
Haven't heard much in terms of vendor support at the security appliance vendor side, or the cert providers side for anything we can migrate to without breaking things. Will need to caveat that with me not spending days looking into it. Just from cursory research for client lifecycle
Re: (Score:2)
I think they're trying to push vendors to support the preferred options (ML-KEM for key establishment, ML-DSA and SLH-DSA for digital signature algorithms). NIST IR 8547 [nist.gov] (still in draft) calls for the same algorithms but with a target date of 2035. OpenSSL is starting to implement these in their mainstream code (Github ticket for ML-KEM-2014 and ML-KEM-512 implementation [github.com]), but it will likely be a while until they're production ready. They've been experimenting with them in the open-quantum-safe project for
Re: (Score:2)
They really should use quantum-resistant algorithms alongside a traditional algorithm for now so that you have to crack both. Quantum algorithms are very new compared to our old favorites. One of the NIST finalists for quantum-resistant crypto was cracked using classical computing near the end of the standardization process, highlighting the danger of relying on these alone.
Re: are there alternatives that will actually work (Score:2)
So a 3-stage cascading algorithm combination then, and applied after data compression?
But for many web pages there's little need for encryption, so it won't matter if the algorithm is obsolete.
Bitcoin and post-quantum algorithms (Score:1)
The summary of this article would have benefitted from the mention that the algorithms mentioned are going to be replaced with post-quantum algorithms. Also, it's worth mentioning, as many governments move away from factorization and discrete-log methods of cryptography to, say, lattice and other methods of post-quantum cryptography, Bitcoin isn't.
One reason that I suspect Bitcoin isn't is because post-quantum algorithm byte lengths are long, most are greater than 700. In comparison, BLS signatures, which E
Experts disagree (Score:2)
Quoting a recent "EMVCo Position Statement, Quantum Computing and EMV® Chip Cryptography"
> The most optimistic projections suggest that the earliest date that a cryptographically significant quantum computer could be built would be around 2040.
Source: an expert report commissioned by EVMco, dated 2024/03/08, marked published 2024/09, online since 2024/12/17 at https://www.emvco.com/resource... [emvco.com] (requires click-thru approval of license terms). I second their opinion.
OMG (Score:2)
Australia wants to replace all the cryptography algorithms on the secret systems they use to transmit highly classified data! But the web depends on thses algorithms!
Fortunately, the web is not a secret Australian high security transmission system.
It is interesting they want to replace SHA-256, but maybe they're just replacing it with SHA-512. Doubling key lengths IS a current recommendation.
Re: (Score:2)
Yeah, it was an interesting choice to include SHA-256 - since that's not thought to be particularly susceptible to quantum attack. But probably the actual review was broader, and (as you pointed out) the reviewers figured "if we're already looking at encryption standards because of quantum attack concerns, we might as well also mandate a move to SHA-512 since that has to happen eventually regardless".
Re: (Score:2)
Most of the recommendations regard SHA (and AES) as "quantum resistant" which means that quantum computers could theoretically speed up cracking them, but not enough to "break" them. So to be safe the recommendation is to increase your key length, which restores your safety to many lifetimes of the universe instead of just a few.
IIRC the quantum attack against hasing and symmetric encryption is search via Grover's algorithm, which optimistically gives you a quadratic speedup, rather than the exponential spe
Re: (Score:2)
I had a feeling SHA-512 was coming, sooner or later. It is a reliable, proven algorithm. Grover's Algorithm turns SHA-512 into SHA-256 pretty much, making it still quite secure.
ZFS when deduplication is turned on, uses sha512, and I'm starting to see other things slowly move that way. It sucks having to have twice the hash length stored, but on the other hand, pretty much everything else in the hashing process can remain the same.
Re: OMG (Score:2)
Most of you have the problem wrong (Score:4, Informative)
Re: (Score:2)
Only if you use short-ass keys for the DH. One reason to _not_ use ECDH, but DH is usually fine.
Also, no relation to SHA-256.
x509 certs are already insecure - attack vector (Score:2)
Re: (Score:2)
That really is not a problem of x.509. Limit cert structure or fix your ASN.1 parser.
Do not let politicians make tech decisions (Score:2)
Or inane, insane crap like this is the result. Yes, DSA (EC or not) is a pretty bad algorithm, but there is nothing wrong with the others and that is not going to change anytime soon.
Re: (Score:2)
Maybe it is a time to trim algorithms. For example, what does RSA offer above ED25519? ED25519's key size is a lot smaller, which makes it much easier to deal with. DSA is still useful for signing, and may even edge out RSA in this respect, so even though RSA has been around a long time, maybe it is time for it to be historical, just like RC4, MD5, and DES?
Re: (Score:2)
In case you did not notice, the small key-sizes of EC crypto _is_ the problem when it comes to Quantum Computing.
Re: (Score:2)
Literally no politicians are making these decisions. They come from the ASD (the Australian version of the NSA). Please get yourself a clue. Literally any clue. Just once surprise us by saying something intelligent.
Re: (Score:2)
You have no standing. I have been an expert in the use of cryptography for a few decades. You were saying?