<story><title>Google&apos;s threat model for post-quantum cryptography</title><url>https://bughunters.google.com/blog/5108747984306176/google-s-threat-model-for-post-quantum-cryptography</url></story><parent_chain><item><author>dist-epoch</author><text>Is there any insight why there is no PQC signature with a short signature?&lt;p&gt;Is it just us failing to find one, or something more fundamental prevents a quantum resistant short signature like?</text></item><item><author>tptacek</author><text>&lt;i&gt;Stateless tokens come with independent security concerns, and moving towards stateful tokens is prudent just to ensure more robust systems. [...] Our main recommendation is to use stateful tokens where possible, given their additional security benefits.&lt;/i&gt;&lt;p&gt;This is smart. PQC schemes often add too much overhead for interoperable cookie sizes. Instead of trying to cram a PQC signature into a cookie, just stop using the stateless cookie designs that require asymmetric signatures.&lt;p&gt;I&amp;#x27;m not sure I buy the Global Risk Institute chart. I get that they need to motivate adoption, but practical cryptanalytic work with quantum computers seems unpromising right now.</text></item></parent_chain><comment><author>bawolff</author><text>Keep in mind it took us quite a while to move to short (ECC based) public key schemes for classical crypto. Although some of that is for non-technical reasons.</text></comment>
<story><title>Google&apos;s threat model for post-quantum cryptography</title><url>https://bughunters.google.com/blog/5108747984306176/google-s-threat-model-for-post-quantum-cryptography</url></story><parent_chain><item><author>dist-epoch</author><text>Is there any insight why there is no PQC signature with a short signature?&lt;p&gt;Is it just us failing to find one, or something more fundamental prevents a quantum resistant short signature like?</text></item><item><author>tptacek</author><text>&lt;i&gt;Stateless tokens come with independent security concerns, and moving towards stateful tokens is prudent just to ensure more robust systems. [...] Our main recommendation is to use stateful tokens where possible, given their additional security benefits.&lt;/i&gt;&lt;p&gt;This is smart. PQC schemes often add too much overhead for interoperable cookie sizes. Instead of trying to cram a PQC signature into a cookie, just stop using the stateless cookie designs that require asymmetric signatures.&lt;p&gt;I&amp;#x27;m not sure I buy the Global Risk Institute chart. I get that they need to motivate adoption, but practical cryptanalytic work with quantum computers seems unpromising right now.</text></item></parent_chain><comment><author>wbl</author><text>There is! It just takes milliseconds to verify and has questionable security</text></comment>