You may E2E the conversation with your mom, but everyone knows how those things go, right? With a little context from your social media profiles, there are no more secrets.

Perhaps it's easier for business leaders to sigh and loosen the purse strings when the disaster (1) is absolutely certain to happen, and (2) will happen at an exact predetermined time.

There's no rationalizing inaction with “it'll be the next CEO's problem” when you know for sure exactly when it will happen and therefore exactly whose problem it will be.

@odr_k4tana @targetdrone @sophieschmieg

Society didn't come together at scale. Society, for the most part, was panicked that the end of the world was nigh.

Business leaders are the ones who came together, presumably because they didn't want their businesses to abruptly screech to a halt on 2000-01-01, and hired an army of programmers to fix the bugs.

@odr_k4tana @targetdrone @sophieschmieg

@dangoodin

Quantum computers need vastly fewer resources than thought to break vital encryption

No, the sky isn't falling, but Q Day is coming, and it won't be as expensive as thought.

Ars Technica (arstechnica.com)

This is very true, and in fact I would expect targeting more public infrastructure that would allow massive disruption (e.g. Central banks, public utilities in major cities, CAs, etc) to be a better ROI, if you're after disruptive effects.

I can't go into too much detail (propin, ndas, etc) but the actual cost of a utility scale machine will be in the hundreds of thousands per day. The time will vary depending on the architecture, but you're looking at order months to hit the P-256 curve. RSA is more of a moving target, but expect similar.

You'd have to be absolutely certain of the value of the key you are cracking to realize a return on that kind of investment.

A lot of people think Y2K was a hoax because there was no huge apocalyptic disaster.

For some reason they find it difficult to believe that the huge apocalyptic disaster would have happened if not for the large, costly effort to fix the bugs *before* the big day.

@targetdrone @sophieschmieg

Yes, it will be stuff like "we're going to spend the next two months cracking the key agreement on this intercept from such and such embassy we intercepted in 2007", probably for decades after the first utility scale machines exist.

However, I could see seemingly lower-value targets getting hit in order to set up aggregation, supply chain, or other attacks.

If I were an attacker, I'd go after the CAs like digicert et al. With a signing key I would forge any site certs I wanted. PQ preparedness won't stop this until the bad CA certs are out of everyone's trust stores.

It's that, plus the fact that the day you migrate to PQC, all your *future* comms are safe, but all your past comms *will* be vulnerable some day.

If those comms contain other key / authentication materials for other parts of the system, then the Adversary will gain access to those as well.

That, and the unfortunate reality that a lot of orgs will drag their feet on this and you'll have vulnerable crypto in prod probably even after the first utility scale machines.

under plausible assumptions, the runtime for discrete logarithms on the P-256 elliptic curve could be just a few days for a system with 26,000
physical qubits