top 19 comments

sorted by: hot top controversial new old
[–] 8 points 1 year ago (14 children)

They still need help upgrading the key exchange to be quantum resistant if anyone needs a summer project.

  • source
  • hideshow 14 child comments
  • [–] 4 points 1 year ago (13 children)

    No they don't "need" help doing that. Quantum resistance is kind of a waste of time considering the largest number factored by these things is 21.

    And the known algorithm we halve just square roots the search space on average. So a 256 bit key is still secure. Quantum resistance just seems like another industry scam to try and take us away from well supported open-source stuff.

  • source
  • parent
  • hideshow 13 child comments
  • [–] 8 points 1 year ago* (last edited 1 year ago) (9 children)

    It's just math and the relentless march of technology. Fear not, we have lots of open source post quantum cryptography libraries.

  • source
  • parent
  • hideshow 9 child comments
  • [–] 2 points 1 year ago (8 children)
  • [–] 6 points 1 year ago*

    The point in time after the first qbit based supercomputers transitioned from theoretical abstraction to physical proven reality. Thus opening up the can-of-worms of feasabily cracking classical cryptographic encryptions like an egg within human acceptable time frames instead of longer-than-the-universes-lifespan timeframes.. Thanks, superposition probability based parallel computations.

  • source
  • parent
  • [–] 3 points 1 year ago (2 children)

    From Wikipedia:

    Post-quantum cryptography, sometimes referred to as quantum-proof, quantum-safe, or quantum-resistant, is the development of cryptographic algorithms that are currently thought to be secure against a cryptanalytic attack by a quantum computer.

  • source
  • parent
  • hideshow 2 child comments
  • [–] 2 points 1 year ago (1 child)

    RSA 4096 is post quantum under this definition.

  • source
  • parent
  • hideshow 1 child comment
  • [–] 3 points 1 year ago*

    RSA 1024 is post quantum if you want to ignore progress in cryptography and use current algorithms. (We have no quantum computers that can crack it right now)

    It's about preparing for quantum computers by using algorithms that are secure against conventional and future quantum computers. If you assume that a quantum computer will exist that can crack RSA 2048/4096, then all data that gets send right now can be decrypted at that time. If we get working quantum computers in 20 years then in 20 years all banking data, chat messages, emails,... send with RSA today can be compromised.
    If we switch to algorithms that don't get easier to crack with quantum computers then even when they get strong enough nothing will change and only data send with older algorithms can be decrypted.

    See also the rest of the Wikipedia article, here a continuation of my previous snippet:

    Most widely used public-key algorithms rely on the difficulty of one of three mathematical problems: the integer factorization problem, the discrete logarithm problem or the elliptic-curve discrete logarithm problem. All of these problems could be easily solved on a sufficiently powerful quantum computer running Shor's algorithm or possibly alternatives.

    As of 2024, quantum computers lack the processing power to break widely used cryptographic algorithms; however, because of the length of time required for migration to quantum-safe cryptography, cryptographers are already designing new algorithms to prepare for Y2Q or Q-Day, the day when current algorithms will be vulnerable to quantum computing attacks.

  • source
  • parent
  • [–] 1 point 1 year ago (3 children)

    After quantum. Algorithms for after a quantum computer can crack what's current.

  • source
  • parent
  • hideshow 3 child comments
  • [–] 0 points 1 year ago (2 children)

    Can they? Can they really break RSA 4096? Because the algorithm we have to do that just turns it from 256 bits of entropy to 128, which is still not breakable.

  • source
  • parent
  • hideshow 2 child comments
  • [–] 3 points 1 year ago (1 child)

    Algorithms. Plural. Shor's and Grover's. Nothing public that can break anything in use but progress marches on and governments are always expected to be 5-10 years ahead

  • source
  • parent
  • hideshow 1 child comment
  • [–] 3 points 1 year ago (1 child)

    The idea that people use quantum computers against meshtastic nodes is pretty funny to me. I think meshtastic attracts a certain kind of person who is security minded and maybe even prepper adjacent (like ham radio tends to). That leads to some odd things like worrying about nation states attacking their nodes.

    To be clear, I'm not saying better security isn't worth it, nor am I saying it wouldn't ever happen, but the idea that folks are hiding things that important on meshtastic is a little silly to me. I think their biggest threat is other hobbyists. Not nation states.

  • source
  • parent
  • hideshow 1 child comment
  • [+] -13 points 1 year ago (7 children)
  • 1 comment in c/meshtastic@mander.xyz view that post
    [–] 4 points 1 year ago

    Meshtastic developers released firmware version 2.6.11 with critical fixes:

    Key generation delay: Keys are now generated when users first set their LoRa region, preventing vendor-side duplication.

    Entropy improvements: Added multiple randomness sources to strengthen cryptographic initialization.

    Compromised key detection: Devices now warn users if known vulnerable keys are detected.

    An upcoming version (2.6.12) will automatically wipe compromised keys. For immediate protection, users should:

    Update devices to firmware 2.6.11 or later.

    Perform a factory reset using Meshtastic’s CLI: meshtastic –factory-reset-device.

    Manually generate high-entropy keys via OpenSSL for critical deployments.

  • source