WEBVTT
00:00:00.215 -->
00:00:04.442David - Recording earlier because like, I don't want to do cold opens anymore.
00:00:04.714 -->
00:00:10.166I just want to have something from before we actually start talking to edit it because I hate copy pasting things in.
00:00:10.827 -->
00:00:11.086Deirdre - Okay.
00:00:12.522 -->
00:00:14.089David - For example, this.
00:00:21.137 -->
00:00:24.512Deirdre - Hello, welcome to Security Cryptography Whatever.
00:00:24.672 -->
00:00:25.106I'm Deirdre.
00:00:25.867 -->
00:00:26.463David - I'm David.
00:00:26.850 -->
00:00:29.670Thomas is on a plane or something like that.
00:00:29.977 -->
00:00:32.537He's either buying a bandsaw or on a plane or both.
00:00:33.789 -->
00:00:35.823He has a bandsaw on a plane.
00:00:35.905 -->
00:00:36.518It's a whole thing.
00:00:36.616 -->
00:00:37.064What do you say?
00:00:39.127 -->
00:00:41.051Deirdre - And I hope he doesn't get arrested.
00:00:41.957 -->
00:00:54.340Um, we have a special emergency pod where we're hopping on to take advantage of the news that there is a new executive order about post-quantum cryptography specifically.
00:00:54.853 -->
00:01:13.783It's not just buried in like 100 pages of a Kyber EO, um, and the, the top line headline is the U.S. government is moving up its post-quantum migration from approximately 2035 to 2030 and 2031.
00:01:14.683 -->
00:01:17.317Uh, so it is ordered, so it shall be done.
00:01:17.671 -->
00:01:20.609Because Golden— because Trump signed it with the big pen.
00:01:21.349 -->
00:01:39.558Um, and so this is our excuse to finally catch up on a bunch of news about quantum attacks and post-quantum cryptography and a whole bunch of other little thingies that have happened in basically the last 3 months that we just never really hopped on the pod and talked about, even though they happened.
00:01:40.376 -->
00:01:43.106Um, David, what do you think?
00:01:43.379 -->
00:01:57.813David - Which had the EO on it because I hit this fun bug where if you set your window height at the exact right spot, the, the dropdown on the Trump White House site would just bounce up and down and up and down and up and down like a Jack Russell Terrier.
00:01:58.280 -->
00:02:03.530Um, but as soon as I started streaming, it adjusted the window size and now you can't see the funny bug.
00:02:03.834 -->
00:02:07.528Anyway, great, great technology, bleeding edge cryptography here.
00:02:07.671 -->
00:02:10.754Okay, so I figured let's just go through the EO.
00:02:11.317 -->
00:02:11.638Deirdre - Sure.
00:02:12.247 -->
00:02:18.008Um, the context for this EO, this executive order from our dear leader, President Trump.
00:02:19.938 -->
00:02:22.328Also, we did not— we do not have a crystal ball.
00:02:22.780 -->
00:02:34.174We have produced multiple episodes, and by we I mean David produced multiple episodes featuring, um, some, you know, fictional presidents.
00:02:34.659 -->
00:02:47.884Yes, the AI Gamer presidents, who, including, including our dear leader, a fake version of our— of President Trump, talking about post-quantum cryptography and quantum cryptography and things like that.
00:02:48.349 -->
00:02:52.838And we do— do not ask us for KALSHI bets.
00:02:53.015 -->
00:02:56.414Do not ask us what the spreads should be for anything else.
00:02:57.569 -->
00:03:01.545We, we were doing satire and unfortunately it became real.
00:03:02.058 -->
00:03:04.817That seems to be a current risk of doing satire.
00:03:04.929 -->
00:03:09.450David - However, the official stance of this podcast is that insider trading makes markets more efficient.
00:03:10.894 -->
00:03:12.257Deirdre - Sure, sure, why not?
00:03:12.722 -->
00:03:12.979Sure.
00:03:13.204 -->
00:03:43.751Anyway, so the context is in, in March, um, there were some results for both improving quantum attacks against especially elliptic curve Diffie-Hellman, or elliptic curve, sorry, the elliptic curve discrete logarithm problem, um, and there were improvements, uh, in, uh, in different ways of producing a quantum computer, specifically about building quantum computers using neutral atoms.
00:03:44.569 -->
00:03:55.639And basically, um, we've— we had multiple results that were kind of percolating amongst, you know, the, the Whisper network, uh, and then got published by Google, uh, predominantly.
00:03:55.735 -->
00:04:08.381They put— I think they published both things, the, the neutral atom stuff and this, uh, this improved attack efficient, more efficient attack against, uh, the elliptic curve discrete logarithm problem.
00:04:08.429 -->
00:04:20.365And they specifically were trying to be like, this is, uh, we think this will make attacking P-256, um, especially EC, the ECDSA signature scheme over P-256, uh, much easier.
00:04:20.605 -->
00:04:31.589And then you put those things together, you— it's much more efficient, uh, to get a, a cryptographically relevant quantum computer, and you get a much more efficient attack algorithm.
00:04:31.589 -->
00:04:47.899And basically the projection of where you get a scary quantum computer that can run a scary, very fast for what we've had before, quantum attack algorithm, especially against elliptic curves, brought that reality, projected reality, a lot closer.
00:04:48.189 -->
00:05:00.610And in response to that, Google and Cloudflare announced that they were gonna be moving their targeted, their target dates to be quantum fully migrated to quantum-resistant cryptography.
00:05:01.185 -->
00:05:03.579Up to the end of 2029.
00:05:04.317 -->
00:05:15.107And then I think a lot of people in the industry like really stood up and started paying attention because that's moving up target dates that people have been working against up by at least 5 years.
00:05:15.172 -->
00:05:16.264It was more 5 or 6 years.
00:05:16.327 -->
00:05:18.062David - Start of 2029 actually is what Google—.
00:05:18.062 -->
00:05:18.928Deirdre - Oh, did they say that?
00:05:19.009 -->
00:05:19.571Oh gosh.
00:05:20.293 -->
00:05:25.833Um, so, but that happened in March-ish, and we'll have links to those in the, in the show notes.
00:05:26.732 -->
00:05:35.370We— some people have been saying there might be a, another Kyber EO, executive order, or a cryptography EO or something like that.
00:05:35.451 -->
00:05:41.028But like, you know, you never know what the fuck's going on, uh, in, uh, our dear leader's, uh, house.
00:05:41.781 -->
00:05:54.747Uh, so this just showed up yesterday, and there's some lovely video of, of Trump just talking, learning the phrase quantum cryptography for the very first time and uttering it.
00:05:55.004 -->
00:05:58.810The result is Um, but it's a lot of fun.
00:05:58.923 -->
00:06:06.334David - And pointing out that no one cares when, when Einstein— what year Einstein published some paper about quantum something or other, apparently.
00:06:06.624 -->
00:06:07.620Deirdre - So here it is.
00:06:07.877 -->
00:06:11.685This is, uh, Securing the Nation Against Advanced Cryptographic Attacks.
00:06:12.134 -->
00:06:21.987And yeah, there's a— there's several things in here actually, because I thought it was just about cryptography, and it's not just about the, the cryptography, uh, of the, uh, the U.S. government.
00:06:22.817 -->
00:06:31.543David - Um, so for the sake of the like 8 readers that, um, take audio only, what we'll do is we'll read through, I think, most of this.
00:06:32.074 -->
00:06:32.137Deirdre - Okay.
00:06:32.281 -->
00:06:36.437David - And then pause and talk through it instead of relying on everybody to simply read the screen.
00:06:37.495 -->
00:06:48.228Um, so section 1, the advent of large-scale quantum computers, particularly in the hands of adversaries, will pose a significant threat to widely used cryptographic security systems.
00:06:48.728 -->
00:07:00.271Ongoing Kyber activity against our nation also presents the risk of adversaries collecting United States information now and decrypting it once the large-scale quantum computers are operational.
00:07:00.543 -->
00:07:02.043Deirdre - I agree.
00:07:02.220 -->
00:07:10.538David - So right off the bat, we have a reference to the store now, decrypt later threat, which we have talked on and on and on about.
00:07:12.416 -->
00:07:20.595I mean, it's still not clear, like, who this risk acts like in the grand scheme of risks.
00:07:21.389 -->
00:07:22.394Where does this apply to you?
00:07:22.702 -->
00:07:26.456But this is sort of the main risk of quantum computers now.
00:07:28.180 -->
00:07:31.149Deirdre - It is the live threat, if that is within your threat model.
00:07:32.096 -->
00:07:40.918David - Um, in light of these threats, the United States must take steps to strengthen cryptographic protection, protections for the nation's sensitive data, critical infrastructure, and digital economy.
00:07:41.987 -->
00:08:03.259Uh, it is the policy of the United States to safeguard national security and maintain technological leadership by responsibly and effectively executing the transition of federal information systems to the NIST-approved Federal Information Processing Standards, FIPS, for post-quantum cryptography, PQC, and to assist critical infrastructure owners and operators with their transitions.
00:08:04.028 -->
00:08:13.422Um, so, um, unfortunately, unlike AI Gamer Obama, who said that he would become a Republican if Doge got rid FIPS.
00:08:14.206 -->
00:08:15.488Um, well, we still have FIPS.
00:08:16.146 -->
00:08:18.949Section 2 is just a bunch of definitions, so we'll skip all of that.
00:08:19.334 -->
00:08:30.040Deirdre - Although the one thing that I will not skip is the term high-value asset, or HVA, um, which has a specific definition and an OMB memo, blah blah blah blah blah.
00:08:30.952 -->
00:08:37.892And this is— and the, uh, another definition that follows, the term national security systems, or NSS.
00:08:38.356 -->
00:08:55.620So Up until about recently, until this memo actually, the U.S. government has been targeting, um, FIPS standards that includes post-quantum cryptography, uh, to be rolled out and in use by any of these applied systems.
00:08:55.683 -->
00:08:58.543So this is like any system that the U.S. government is using.
00:08:58.654 -->
00:09:03.971This includes like the Department of Education to, you know, this freaking website that we're looking at.
00:09:04.019 -->
00:09:08.365I'm pretty sure this has to be served with NIST curves or something like that at the moment.
00:09:08.831 -->
00:09:15.740Um, that's all U.S. federal government, uh, from very boring stuff to less boring stuff.
00:09:16.284 -->
00:09:43.125For national security systems like Department of Defense stuff or NSA stuff or top secret SCI, no foreign system stuff like that, they have their own suite of more constrained algorithms that are basically a subset of the FIS FIPS stuff, and they are using PQ only, no hybrid, except for, you know, if you're doing IPsec or something like that, you're doing some VPN stuff, they trust elliptic curves a little bit.
00:09:43.719 -->
00:09:51.124Um, they just have a much more constrained set, and they have all of the parameter sets pegged to the most tippy-top parameter set possible.
00:09:51.830 -->
00:10:02.847Um, those were all trying to get migrated by the end of 2035, although I think there were different targets for different systems for CNSA 2.0.
00:10:02.927 -->
00:10:04.870They were trying to get some stuff migrated earlier.
00:10:06.043 -->
00:10:12.450David - For CNSA 2.0, it's really vague, but it was kind of already closer to 2031 for most things.
00:10:12.625 -->
00:10:26.958And there's a statement that's very vague about like new systems, new, new procurements should be like CNSA 2.0 compliant in starting in 2027, which like is just on one hand, just like not gonna happen at all.
00:10:27.312 -->
00:10:35.711On the other hand, like, um, talking with the people that wrote that, what it really means is you better not be charging us an extra update for it.
00:10:36.207 -->
00:10:36.288Deirdre - Right.
00:10:36.368 -->
00:10:36.945David - Uh, okay.
00:10:37.426 -->
00:10:37.682Deirdre - Yeah.
00:10:38.082 -->
00:10:42.860David - So, um, they should be doing as much CNSA 2 things as are reasonable.
00:10:43.035 -->
00:10:43.100Deirdre - Yeah.
00:10:43.517 -->
00:10:51.339David - So for example, like you're not gonna have, uh, um, an HTTPS certificate that's CNSA 2 compliant for like a number of years.
00:10:52.340 -->
00:10:52.629Deirdre - Yeah.
00:10:52.775 -->
00:10:52.856Bye.
00:10:55.442 -->
00:10:56.753That's publicly trusted.
00:10:56.979 -->
00:10:57.285Yes.
00:10:57.464 -->
00:10:58.530David - That's publicly trusted.
00:10:58.596 -->
00:10:58.740Deirdre - Yeah.
00:10:58.837 -->
00:11:01.182David - For private PKIs, you can do whatever you want.
00:11:01.296 -->
00:11:01.619Starting—.
00:11:01.619 -->
00:11:03.485Deirdre - You can basically do it now, depending—.
00:11:03.501 -->
00:11:06.698David - In Chrome 150, which releases on June 30th.
00:11:07.149 -->
00:11:08.048So 7 days from now.
00:11:08.577 -->
00:11:09.125Deirdre - That's nice.
00:11:09.525 -->
00:11:09.943David - You'll be—.
00:11:09.943 -->
00:11:10.715Deirdre - Breaking news.
00:11:10.988 -->
00:11:12.464Breaking news on the podcast.
00:11:12.529 -->
00:11:13.610David - I don't know that it's breaking.
00:11:13.741 -->
00:11:16.758It's like on a public site describing Chrome releases.
00:11:17.322 -->
00:11:18.341Deirdre - This is a scoops.
00:11:18.455 -->
00:11:19.506We're doing scoops.
00:11:19.604 -->
00:11:20.138Scoops.
00:11:20.477 -->
00:11:22.759Who cares where the information came from?
00:11:22.823 -->
00:11:23.488It's an exclusive.
00:11:23.649 -->
00:11:27.722David - It's been discussed on IETF threads by other implementers.
00:11:28.158 -->
00:11:28.255Uh-huh.
00:11:29.918 -->
00:11:30.466Breaking news.
00:11:32.096 -->
00:11:43.390Deirdre - One of the only other definitions in the section is the Cryptographic Module Validation Program, the CMVP program, which is part of getting FIPS certified.
00:11:43.438 -->
00:11:49.794So if anyone has ever mentioned anything about being FIPS certified, This is the program that basically does it.
00:11:50.178 -->
00:12:00.977It started with hardware and firmware implementations and then they just said also we'll, we'll certify software implementations of FIPS stuff in a module, in a module boundary.
00:12:01.313 -->
00:12:03.380And it's, you know, it's a whole thing.
00:12:04.038 -->
00:12:14.836And unfortunately it leads to kind of, you know, reading the tea leaves to try and predict what will be FIPS certifiable or not in the program, the lab that does the program.
00:12:15.332 -->
00:12:16.999And a lot of that is wrong.
00:12:17.432 -->
00:12:19.567But that's what that is.
00:12:19.985 -->
00:12:20.852And we'll talk about that later.
00:12:20.933 -->
00:12:23.390David - There's, there's two types of FIPS certification actually.
00:12:23.456 -->
00:12:32.451There's the, well, there's a bunch of types, but relevant to this, there's, there's the CMVP, the Cryptographic Module Validation Program, which is the really annoying one to get.
00:12:32.595 -->
00:12:32.692Deirdre - Yeah.
00:12:32.932 -->
00:12:34.458David - That a lot of things require.
00:12:34.602 -->
00:12:38.571And then there is Cryptographic Algorithm Validation, CAVP.
00:12:38.634 -->
00:12:38.730Deirdre - True.
00:12:38.796 -->
00:12:38.940David - Yes.
00:12:39.437 -->
00:12:41.654Which is more straightforward to get.
00:12:42.008 -->
00:12:47.782'Cause CAVP is like, did you implement this algorithm correctly based on like some test vectors.
00:12:47.831 -->
00:12:48.106Mm-hmm.
00:12:48.610 -->
00:13:05.316Deirdre - And CMVP is like, do you meet all of these arbitrary other like, um, requirements that make it very difficult to test in like, like how do you, like, everything has to be within a module boundary and it has to be started up a certain way.
00:13:05.943 -->
00:13:09.133David - And this is why it needs to be able to do a self-test with fixed random.
00:13:09.197 -->
00:13:12.823So you have to build in like a backdoor to your system to prove that it operates correctly.
00:13:12.892 -->
00:13:14.691Basically it's a pain in the ass.
00:13:15.076 -->
00:13:15.317Deirdre - Yeah.
00:13:15.542 -->
00:13:24.404David - Um, and then you have to certify it on every, uh, uh, well, depending you, in theory, it, the certification only applies to specific environments.
00:13:24.452 -->
00:13:28.033So for example, like Arch Linux 4.0 on a Chromebook.
00:13:28.547 -->
00:13:28.628Deirdre - Yeah.
00:13:28.803 -->
00:13:31.100David - Or like Debian in Google Cloud.
00:13:31.533 -->
00:13:31.677Deirdre - Yeah.
00:13:31.759 -->
00:13:39.208David - Um, and in practice what you do is you get some bullshit certified for some platform and then you convince your auditor that that's what everything is.
00:13:39.562 -->
00:13:39.722Deirdre - Yep.
00:13:40.124 -->
00:13:49.591But you still have to like juggle all of those like certs in case you, your compliance auditor is like, is your cert for this module on this platform is still up to date?
00:13:50.138 -->
00:13:51.774And you have to keep it alive.
00:13:51.839 -->
00:13:58.386And that's a lot of juggling and, you know, bookkeeping for questionable amounts of additional security.
00:13:58.692 -->
00:14:05.513David - So, and then NIST will take like 6 to 18 months to actually issue your certificate once you pass the testing.
00:14:05.961 -->
00:14:06.298Deirdre - That too.
00:14:06.764 -->
00:14:06.926Okay.
00:14:07.005 -->
00:14:09.702Section 3, Coordinating the PQC Transition.
00:14:09.799 -->
00:14:30.817The Director of OMB and the National Kyber Director, in consultation with the Assistant to the President of National Security Affairs and the Administrator of the Office of Electronic Government— I didn't know that that was a thing— OMB shall lead the strategic coordination oversight of the national PQC migration policy and strategy set forth in this order, ensuring its alignment with broader cybersecurity goals.
00:14:31.412 -->
00:14:42.524B, the Secretary of Commerce, Blutnick, through the Director of NIST and in consultation with the Director of National Security Agency, NSA, and the Secretary of Homeland Security.
00:14:43.823 -->
00:14:44.931Is that still known?
00:14:45.347 -->
00:14:46.566Do we have an acting secretary?
00:14:46.951 -->
00:14:49.035David - We— I don't remember who it is, but it's not known anymore.
00:14:49.131 -->
00:14:49.870Deirdre - I think we need—.
00:14:49.933 -->
00:14:53.639David - I think it's an acting secretary at the moment, but they have to be approved.
00:14:54.168 -->
00:14:54.248Yeah.
00:14:54.585 -->
00:14:54.937Deirdre - Oh gosh.
00:14:55.610 -->
00:15:01.784Uh, through the Director of the Cybersecurity Infrastructure Security Agency, CISA, and the Department of Redundancy Department.
00:15:02.426 -->
00:15:10.726Shall provide agencies on ongoing basis with comprehensive technical guidance on PQC implementation, including best practices, implementation, and risk management strategies.
00:15:11.014 -->
00:15:11.366David - Cool.
00:15:11.720 -->
00:15:15.356Just what we needed, more guidance from CISA.
00:15:15.998 -->
00:15:18.802Deirdre - Section 4, Accelerating the PQC Transition.
00:15:18.866 -->
00:15:35.909Within 30 days of the date of this order, which is yesterday, uh, June 22nd, each agency head shall identify its PQC migration lead and provide the name and contact details of the PQC migration lead to the Director of OMB and the National Kyber Director within 90 days.
00:15:36.182 -->
00:15:36.408Yes.
00:15:36.825 -->
00:15:37.000David - Yeah.
00:15:37.081 -->
00:15:44.783So this is like fairly standard stuff for like how a government, like the executive branch, tells agencies to do things.
00:15:44.831 -->
00:15:55.969There's like a similar, um, guidance around like doing inventory a while ago that's like, yes, define a point person, and then that person has to submit a report to these other people that contains these things.
00:15:56.481 -->
00:15:57.220Blah, blah, blah, blah, blah.
00:15:57.589 -->
00:16:00.202And then you need to do this other thing by this other time.
00:16:00.250 -->
00:16:09.615And then that all goes through the point person back to whoever, as deemed by the authority stated at the top, which in this case is like NSA plus Secretary of Commerce.
00:16:10.017 -->
00:16:10.193Deirdre - Yep.
00:16:10.594 -->
00:16:18.467And we explored a lot of that when we talked about the, the big Kyber EO that came down just before the end of the Biden administration.
00:16:18.532 -->
00:16:19.975And it's like a lot of similar stuff.
00:16:20.937 -->
00:16:32.239David - Um, I think the big takeaway in this section is that like, we've included the HVAs, the high impact systems and national security systems.
00:16:33.794 -->
00:16:56.100And given this like, timeline for both key establishment at the end of 2030 and then digital signatures by the end of 2031, which, you know, very nice that these have actually been split out because it's much, much, much, much easier to do key establishment that it is to do signatures in most cases.
00:16:56.196 -->
00:17:01.313And you can actually just like, doing key establishment is basically just update your OpenSSL.
00:17:01.602 -->
00:17:02.149Mm-hmm.
00:17:02.229 -->
00:17:02.677At this point.
00:17:03.255 -->
00:17:14.615Deirdre - And, or, you know, your Go, you like, you can upgrade Go, you can upgrade, uh, I think it's in Java 25 or JDK 25, um, that you get it as well.
00:17:14.825 -->
00:17:27.729Like a lot of the places where you just update, uh, and you are serving TLS, for example, Um, you will get your post-quantum FIPS interoperable, uh, key agreement and it just works.
00:17:28.692 -->
00:17:41.277Uh, it's not that easy if you're using, uh, signatures and you need to share, uh, a public key or rotate keys or certs or have any sorts of roots of trust or anything like that.
00:17:41.452 -->
00:17:41.630David - Yeah.
00:17:42.030 -->
00:17:53.972Fundamentally, like independent of any of the like struggles with size that we've discussed with PQC in the past, um, like you are going to have a new trust hier— like a PKI hierarchy for PQCE.
00:17:54.550 -->
00:17:54.680Deirdre - Yeah.
00:17:54.776 -->
00:18:00.057David - Which means that like, in some way you're going to have to get a certificate from like something vaguely new.
00:18:00.554 -->
00:18:23.440And like, even if that certificate is done in such a way that it looks like this looks like the old stuff to old things, like at some point your ACME client's gonna have to either be pointed at a new endpoint or have that endpoint just like do some sort of, uh, you know, Indiana Jonesing to a new hierarchy when you're not looking., um, uh, and actually have like certificates issued.
00:18:23.440 -->
00:18:23.980Deirdre - Yeah.
00:18:23.980 -->
00:18:43.220David - Which is just fundamentally like more work, hopefully marginally more work, and hopefully mostly handled, um, automatically still, but like not as straightforward as, oh, I've just updated my, my SSL/TLS implementation and now there's a new cipher suite available and you just use that with new things.
00:18:43.220 -->
00:18:44.440Deirdre - And now—.
00:18:44.440 -->
00:18:47.640David - Because it involves a long-lived credential instead of just an ephemeral credential.
00:18:48.152 -->
00:18:48.311Deirdre - Yep.
00:18:48.777 -->
00:18:52.704And not even like long-lived, but just like someone needs to trust it in some way.
00:18:52.800 -->
00:18:56.936It needs to be sort of like, have some sort of like, where does this come from?
00:18:57.113 -->
00:18:58.428Did like, is this real?
00:18:58.491 -->
00:19:00.847Is this like not expired and things like that?
00:19:01.602 -->
00:19:11.925Um, and we, and we haven't even gotten an update to, uh, SSH or OpenSSH for, uh, keys, the actual keys that do the signing for you.
00:19:12.038 -->
00:19:17.109We have gotten an update, uh, for the key agreement of your SSH session in OpenSSH.
00:19:17.173 -->
00:19:18.586So that's cool.
00:19:19.019 -->
00:19:24.559But we still aren't sure what SSH, uh, pub keys, PQ pub keys are gonna look like yet.
00:19:24.785 -->
00:19:26.791Um, there's still discussion going on about that.
00:19:27.513 -->
00:19:28.348Um, yay.
00:19:29.602 -->
00:19:49.523Um, but one, one of the huge things is like, okay, 2030 for key agreement, like that's kind of on par, but the fact that they're moving up signatures to be done by the end of 2031 is pretty big because we, that is a short runway for things that don't have solved solutions ready to go yet.
00:19:50.133 -->
00:19:51.798And it's like aggressive.
00:19:51.926 -->
00:19:54.250So that, that was a big thing that caught my eye.
00:19:55.019 -->
00:19:55.099David - Yeah.
00:19:55.292 -->
00:20:03.048I mean, Chrome's expecting to be able to accept, um, post-quantum, uh, Merkle tree certificate CAs in 2027.
00:20:04.154 -->
00:20:04.346Um, cool.
00:20:05.596 -->
00:20:09.891Uh, but the first round of those will not have key strengths suitable for CNSA 2.
00:20:10.036 -->
00:20:11.877Oh, you're right.
00:20:12.199 -->
00:20:16.269Um, but it will be, yeah, they'll get there eventually, but they'll at least be PQC.
00:20:16.348 -->
00:20:18.528And this actually doesn't say anything about key strength.
00:20:18.992 -->
00:20:19.410Deirdre - Correct.
00:20:19.795 -->
00:20:24.569I think it's just, it needs to be FIPS, which means if it supports ML-DSA 44, you're good.
00:20:24.826 -->
00:20:29.201And I think a lot of people will be perfectly well suited to use ML-DSA 44.
00:20:30.034 -->
00:20:36.029David - Um, Yeah, it's really complicated to decide what's, um, like a national security system.
00:20:36.125 -->
00:20:46.673If you talk to most people from like NSA, they'll be like, oh, you know, that's like the DOD servers running in like a DOD data center or whatever, like on a private DOD network.
00:20:47.428 -->
00:20:49.446And it's like, yes, that's definitely true.
00:20:50.313 -->
00:20:56.373Um, but like what, like more and more of the government uses like public clouds and SaaS.
00:20:56.902 -->
00:21:02.163And then you have the question of like, is your cloud console considered a national security system?
00:21:02.661 -->
00:21:02.998Deirdre - Yeah.
00:21:03.159 -->
00:21:10.073David - You are deploying using that cloud console to deploy, uh, you know, a national security system on some cloud.
00:21:10.121 -->
00:21:10.394Deirdre - Yeah.
00:21:10.682 -->
00:21:22.875David - Um, and then like now you have like a whole host of basically publicly accessible websites that become in scope for rules that were written to be for like, uh, basically a DoD network.
00:21:23.682 -->
00:21:25.979Which is where all of this gets complicated.
00:21:26.059 -->
00:21:43.037Deirdre - It's like, do I really need— does like AWS have to serve me, uh, an mldsA87 cert and everything in that chain and an MLKEM1024, uh, key exchange just to like, you know, load up the console?
00:21:43.792 -->
00:21:46.593Like, I don't— maybe, I don't know, I don't work for them.
00:21:48.553 -->
00:21:57.858David - MLKEM1024 is like not that bad in the grand scheme of things compared to— whereas like mldsA87 is It's just like, you really gonna send me 35 kilobytes of certs?
00:21:58.002 -->
00:21:58.596Like, come on.
00:21:58.726 -->
00:21:58.806Deirdre - Yeah.
00:21:59.304 -->
00:22:09.824Like, when you're sort of thinking about like, well, yes, if you are like doing X-keystore crap, like the stuff that Snowden leaked, you know, sure.
00:22:09.951 -->
00:22:16.344I give me the fat, you know, NIST Level 5 certs and like, sure, gimme ML-KEM 1024.
00:22:16.553 -->
00:22:29.076But when you're just like, well, you know, if you're trying to twiddle something in the like, defense cloud that is being served by, you know, AWS, like, do you need it there too?
00:22:29.156 -->
00:22:30.858And like, it, the answer might be yes.
00:22:30.923 -->
00:22:32.143And then you're just like, oh, goddammit.
00:22:32.191 -->
00:22:39.142Like, to just serve me a website, a regular website, um, you need to support this stuff is like, oh boy.
00:22:39.431 -->
00:22:39.672Okay.
00:22:39.929 -->
00:22:51.358David - The struggle is if you can't split your domain, like split your users by domain, because it's easy to make one domain that only uses the high strength stuff and another domain that uses like the normal strength stuff.
00:22:51.856 -->
00:22:58.421To be clear, the normal strength stuff is like strong enough to survive like a Dyson sphere built around the sun being used to like brute force it.
00:22:58.773 -->
00:23:14.469But, um, like if you say you're on a search engine, if that somehow becomes in scope for a national security system, like you probably don't actually want to pay, um, the cost of the cryptography for, you know, a few billion users.
00:23:14.965 -->
00:23:15.222Deirdre - Yeah.
00:23:16.250 -->
00:23:16.892Um, all right.
00:23:16.971 -->
00:23:21.113Well, the last rest of the section, advancing to Section 6.
00:23:21.289 -->
00:23:27.058David - Procurement, um, because I think everything else is more just like reporting details on timing and reporting.
00:23:27.555 -->
00:23:29.863Yeah, Section 6 procurement is where it gets exciting.
00:23:30.296 -->
00:23:46.401Deirdre - Hold on, hold on, at the end of Section 5, uh, uh, um, Homeland Security shall release public guidance regarding cryptographic bill of materials and they should enable the automated assessment of assets utilized by hardware software element.
00:23:46.464 -->
00:23:51.778I'm like Great, we're just gonna keep doing that.
00:23:51.857 -->
00:23:53.881We're gonna keep doing C-bombs.
00:23:54.170 -->
00:24:01.939Okay, sure, we're moving the timelines up super aggressively, but first we gotta get that bill of materials.
00:24:02.355 -->
00:24:06.000Oh, okay, sure, maybe you gotta do that.
00:24:06.048 -->
00:24:13.127David - I don't remember this for sure, but I feel like some of the like S-bomb stuff got revoked by an earlier Trump EO, but maybe—.
00:24:13.368 -->
00:24:24.720Deirdre - Oh, that— yeah, that might have been in the Kyber EO, and he wrote like a few months after he came into office, he basically had a short one that was like, revoke all that except for this, this, this, and this.
00:24:24.847 -->
00:24:26.053It might— that might have been it.
00:24:27.079 -->
00:24:29.248But, uh, uh, 6.
00:24:29.922 -->
00:24:48.179David - So moving on to Section 6, procurement, Section B - Within 180 days of the date of this order, the Secretary of Commerce, through the Director of NIST, shall, to the extent appropriate and consistent with applicable law, revise the processes used by the Cryptographic Module Validation Program to accelerate validations of cryptographic modules.
00:24:49.077 -->
00:24:52.354Um, now what does it mean to revise these processes?
00:24:52.611 -->
00:24:53.093I don't know.
00:24:53.815 -->
00:24:59.145Um, I also, like, I'm gonna be pessimistic about this cuz I don't really know how you fix these things.
00:24:59.193 -->
00:25:02.645I think you just get rid of, like, in my opinion, we shouldn't have CMVP at all.
00:25:03.064 -->
00:25:04.862We should just have CAVP, if that.
00:25:06.034 -->
00:25:09.824Really, we should just have the FIPS list of algorithms and say like, these are the ones that you have to use.
00:25:10.513 -->
00:25:20.583And like, you don't, you know, we, we expect that like software works correctly and like that's part of, you know, the purchasing agreement is that like software works correctly.
00:25:20.791 -->
00:25:20.872Right.
00:25:20.951 -->
00:25:21.289Mm-hmm.
00:25:21.465 -->
00:25:22.493If it doesn't, it gets fixed.
00:25:23.039 -->
00:25:28.773This is kind of how all software works, but somehow it becomes like just the cryptographic algorithm part and not the network part.
00:25:28.837 -->
00:25:30.894It's like, oh, well we have to do all this additional testing.
00:25:31.103 -->
00:25:35.391It's like, yeah, you should, you know, make sure that you're procuring software that works for your use case and works well.
00:25:35.888 -->
00:25:49.419But like, do we really need this like additional testing versus saying, you know, Yes, this, this software complies with the guidelines in the sense of it uses the algorithms that the NSA wants to use for the national security systems.
00:25:49.868 -->
00:25:54.515It like meets the product requirements that are required to do the government thing.
00:25:55.494 -->
00:25:55.929So I don't know.
00:25:55.993 -->
00:25:58.147I suspect that we will not get rid of CMVP.
00:25:58.869 -->
00:26:02.163And as a result, I don't really know like how to improve CMVP very well.
00:26:02.741 -->
00:26:02.903Yeah.
00:26:03.047 -->
00:26:06.035I haven't specifically taken something through CMVP.
00:26:06.180 -->
00:26:14.364I've, you know, worked with teams that I've had to make changes so that it can go through CMVP, but I've not been the point person to like, take something to a lab, get it tested, submit that to NIST, and so on.
00:26:14.797 -->
00:26:37.676Deirdre - I bet, I bet we know some people who do have opinions, but I am quite— the way this, this is written, I'm a little bit worried now because it's like within 180 days, the revise the processes, like you have 6 months to revise the processes, not come up with a plan, give to go up the chain about how you're going to revise the processes.
00:26:37.788 -->
00:26:39.118Like, no, you're going to change them.
00:26:39.728 -->
00:27:01.461David - So I'm, I mean, I think 6 months is more than enough time to change the processes, but like, you know, government, government, it's, it's also tough to do because like in practice, like at least for, for, uh, like CNSA too, a bunch of this also goes through NIAP where then like NIAP has a protection profile that is like in theory above and beyond just the CMVP.
00:27:01.830 -->
00:27:07.525That's like, oh, you know, you have this broader set of requirements and NIAP is supposed to check that all of that complies with those requirements.
00:27:07.781 -->
00:27:22.729But in practice, like, NIAP just writes requirements that are impossible to comply with and, like, make no sense, and, like, combine requirements for clients and servers and then say that you have to follow all of them, but in ways that just don't make sense.
00:27:23.901 -->
00:27:37.708And so getting any, like, NIAP protection profile for a product, which again is also done through, like, a third party, so you, like, take it to a tester, like, Booze Allen Hamilton, and then they like, well, that's a thing, and send it to NIAP.
00:27:38.431 -->
00:27:43.681Um, and then just like, nope, nobody, like the testers don't understand the product.
00:27:43.760 -->
00:27:45.414NIAP doesn't understand TLS.
00:27:45.672 -->
00:27:47.309And then everybody's just trying to get it through.
00:27:47.679 -->
00:27:53.957But also like you're, it's just a bunch of people like bullshitting and lying each other to each other until eventually you get the stamp.
00:27:54.021 -->
00:27:59.336And then what is used in practice is not at all what was tested because the requirements were like literally impossible to comply with.
00:27:59.945 -->
00:28:04.788Even though like the requirements from CNSA 2 are actually very straightforward.
00:28:06.200 -->
00:28:06.585Deirdre - Oh gosh.
00:28:06.698 -->
00:28:12.423I keep forgetting about NIAM and yeah, I don't, I've looked at it once and I'm just sort of like, okay, sure.
00:28:12.790 -->
00:28:12.935David - Yeah.
00:28:13.192 -->
00:28:29.150Like the NIAM protection profiles don't like correctly discern between like must offer something and must negotiate something when a client or a server, so it'll be like, you TLS client, like you must offer You must use Extended Master Secret with TLS 1.2.
00:28:29.150 -->
00:28:37.410And it's like, well, if you're like a web browser, like, you know, what, what happens if like the server, like we offer it in Chrome, but like not every server speaks that.
00:28:37.410 -->
00:28:40.049I think most do, but like, are we just supposed to reject it?
00:28:40.049 -->
00:28:44.369And then they're like, oh, well you must use, you know, AES-256, cuz that's what's in CNSA2.
00:28:44.369 -->
00:28:50.529It's like, well, here's the incantation you can put in to make it so you get AES-256 with Google.
00:28:50.529 -->
00:28:57.390But like, if we just turn off AES-256 in like Chrome, for example, then you just can't load most The internet.
00:28:57.390 -->
00:28:57.730Deirdre - Yep.
00:28:57.730 -->
00:28:59.690David - Because it's all using AES-128.
00:28:59.690 -->
00:29:00.309Deirdre - Yep.
00:29:00.309 -->
00:29:01.730Which is fine, by the way.
00:29:01.869 -->
00:29:02.990Uh, I don't know.
00:29:02.990 -->
00:29:09.890There was a, a lovely blog post that went around recently because people were like, oh, so to be post-quantum, we need to go to AES-256.
00:29:09.890 -->
00:29:11.490And it's like, no, actually you don't.
00:29:11.490 -->
00:29:13.589And I guess people don't, don't know this.
00:29:13.589 -->
00:29:20.269Basically Grover's is not efficient against, uh, against thing, especially things like AES, but even hash functions.
00:29:20.269 -->
00:29:22.849AES-128 is, is fine.
00:29:22.849 -->
00:29:23.910You do not need to upgrade.
00:29:23.910 -->
00:29:35.744The only reason you need to upgrade is if you need to be compliant with CNSA 2.0, and that's just because they, they put all the parameter sets to 11, not because they actually are protecting against Grover's attack.
00:29:35.988 -->
00:29:37.250Anyway, sidebar.
00:29:38.546 -->
00:29:41.769David - Anyway, so my feedback is to just simply get rid of CMVP entirely.
00:29:43.498 -->
00:29:44.210Deirdre - Who knows?
00:29:44.646 -->
00:29:48.382Like, we've already had Doge come, come through our government.
00:29:48.511 -->
00:29:49.547You— who knows?
00:29:49.660 -->
00:29:50.986Maybe that will actually happen.
00:29:51.098 -->
00:29:52.538It'd be very, very interesting.
00:29:54.420 -->
00:29:55.893Uh, anything else?
00:29:56.217 -->
00:30:00.328Oh, uh, contractor vulnerability disclosure programs.
00:30:01.493 -->
00:30:01.786Cool.
00:30:03.809 -->
00:30:09.963That VDPs incorporate reports of cryptographic vulnerabilities including testing for lack of encryption, the use of non-FIPS approved algorithms.
00:30:10.481 -->
00:30:12.262Cool, that's neat.
00:30:12.665 -->
00:30:13.409What's FAR?
00:30:13.651 -->
00:30:18.297David - It was probably the Federal Acquisition Regulatory Council.
00:30:18.490 -->
00:30:19.183Deirdre - Oh, okay.
00:30:19.596 -->
00:30:21.826David - Uh, I think this is probably going to be a net negative.
00:30:22.723 -->
00:30:33.855Um, well, I don't know, like, what do they mean by, I guess it's probably in the definitions up above, but like contractor, if contractor means like labs, like, I hope they don't, aren't like having the labs check for vulnerabilities.
00:30:34.449 -->
00:30:40.737If they're just saying like people that we're buying cryptography from should have a vulnerability disclosure program, then like, sure.
00:30:41.185 -->
00:30:42.678Deirdre - Yeah, I guess that sounds good.
00:30:42.773 -->
00:30:45.324David - Everyone should have a vulnerability disclosure policy.
00:30:45.388 -->
00:30:47.009Most people should not have a bug bounty.
00:30:47.887 -->
00:30:50.925Yeah, that is my stance.
00:30:52.228 -->
00:30:57.838Uh, and, uh, I think, and then Section 7 is the none of this is illegal section.
00:30:58.192 -->
00:31:03.517Deirdre - Hopefully the costs for the public issue of the source shall be borne by the Department of Commerce.
00:31:03.981 -->
00:31:06.044Of course, poor, poor them.
00:31:06.301 -->
00:31:06.945Poor Litnik.
00:31:07.123 -->
00:31:07.333Cool.
00:31:07.847 -->
00:31:09.990Yeah, so that's, uh, that's it.
00:31:10.345 -->
00:31:12.519That's, uh, that's the EO.
00:31:12.980 -->
00:31:13.780It's very exciting.
00:31:14.230 -->
00:31:14.535David - Yeah.
00:31:14.631 -->
00:31:31.468So I think takeaways for most people should just be to update your TLS server software or, um, which if you're like using a VM, you can just like do now and you should be getting TLS Quantum Key Exchange out of the box, probably hybrid, um, 25519 with MLKEM768.
00:31:31.613 -->
00:31:33.296That's enabled by default in, yep.
00:31:33.777 -->
00:31:39.597I believe like OpenSSL 3.5 and newer and boringSSL and all the other SSLs.
00:31:40.160 -->
00:31:40.319Deirdre - Yep.
00:31:40.449 -->
00:31:45.669David - If you're using a, like, TLS load balancer from a cloud, it probably supports all of those now as well.
00:31:45.798 -->
00:31:47.242And if not, it will very soon.
00:31:48.126 -->
00:31:56.335And like, again, the step there will just be to like, roll your config to the new version, enable it, or just let it update itself depending on, you know, how you're configured.
00:31:56.977 -->
00:31:58.743And all of that should be pretty straightforward.
00:31:59.369 -->
00:32:05.666And then for publicly accessible websites, like, you're just gonna need to wait until the certificates are available.
00:32:06.116 -->
00:32:06.196Deirdre - Yeah.
00:32:06.292 -->
00:32:09.102David - And then you have just a certificate management problem, you know?
00:32:09.246 -->
00:32:09.358Deirdre - Yep.
00:32:09.968 -->
00:32:17.270Uh, and you know, Modulo Chrome trusting, Modulo Chrome having a, a trust store beyond Merkle tree certs.
00:32:17.913 -->
00:32:36.460Um, I'm pretty sure that a lot of publicly trusted CAs, um, either already have ML-DSA support, um, like operational, they just don't have an ML-DSA root, uh, in other root stores, trust stores out in the world.
00:32:36.635 -->
00:32:39.232It's kind of a little bit of a chicken and an egg issue with them.
00:32:39.569 -->
00:32:45.836Um, and this is regular schmegular ML-DSA certificates, not the fancy new, new gen Merkle tree certs.
00:32:46.301 -->
00:32:50.758David - Um, no, those are like not gonna end up being an option for publicly trusted sites.
00:32:50.806 -->
00:32:58.372Like at this point, like all but like a lot of the browsers have signaled in various forums, not to speak on behalf of any of them.
00:32:58.644 -->
00:32:59.156Um, yeah.
00:32:59.606 -->
00:33:08.258That like the, because of the need for transparency for public PKIs, meaning like the full set of certificates is publicly disclosed.
00:33:08.756 -->
00:33:09.076Deirdre - Yeah.
00:33:09.173 -->
00:33:27.310David - Um, uh, the, if there was a, a non-Merkle tree certificate, which we haven't really defined, but we've been talking around, but if there was an old style ButML DSA, like root store, that would require old style certificate transparency and that system would fall over, um, in a post-quantum world for a number of reasons.
00:33:27.935 -->
00:33:38.497Deirdre - And so in a post-quantum world, or you could just do something, a terrible bridge where you have your ML-DSA cert, but you have, uh, ECDSA, uh, transparency statements.
00:33:38.689 -->
00:33:45.194David - That would still fall over publicly in a sense, because like the full certificate contents are logged.
00:33:45.660 -->
00:34:05.500And so if you like drastically increase the size of the certificate, the set of people that are currently basically running CT logs out of the goodness of their heart,, would probably not be super happy about, you know, um, these things that are just like basically a net negative to run suddenly, like doubling, quadrupling, 10x-ing in storage costs.
00:34:05.500 -->
00:34:05.960Deirdre - Yeah.
00:34:05.960 -->
00:34:10.239I, I was thinking of literally all the SIGs and, and key public keys that you're downloading.
00:34:10.739 -->
00:34:11.059Yeah.
00:34:11.059 -->
00:34:20.940Those would be smaller if you did a little bit of mix and match and relied on and just kind of, you know, crossed your fingers that the transparency benefits, uh, be given by ECDSA would give you a little bit longer.
00:34:20.940 -->
00:34:24.853But you're right, for the log operators, there still gets They'll still get fucked.
00:34:25.077 -->
00:34:32.657David - Yeah, but there are definitely a number of companies that offer like private PKI ML-DSA products right now.
00:34:33.251 -->
00:34:34.744Yeah, I think I've done it for a while.
00:34:35.032 -->
00:34:43.623There are many HSMs that support it, although none of them have a CMVP yet, um, because NIST is just behind on, uh, on approving them.
00:34:44.106 -->
00:34:46.434Yes, they have CAVPs but not CMVPs.
00:34:46.916 -->
00:34:55.059Deirdre - Was it the first, uh, validated implementation of ML-DSA was only like this year, 2026 or something like that, that finally got through.
00:34:55.059 -->
00:34:58.380And it was in the pipeline for like 18 months or something like that.
00:34:58.380 -->
00:34:59.059David - It took so long.
00:34:59.199 -->
00:35:02.679The final standard was released in like July of 2024.
00:35:02.679 -->
00:35:04.059Deirdre - Yeah, I think that's correct.
00:35:04.059 -->
00:35:05.150Yeah, or August, I forget.
00:35:05.659 -->
00:35:06.489David - Yeah, July or August.
00:35:07.239 -->
00:35:08.199Deirdre - Yeah, and it took that long.
00:35:08.199 -->
00:35:13.940They, they had it ready to go and they, they shoved it in there and it took that long to get validated or whatever.
00:35:13.940 -->
00:35:18.099David - Yeah, it was an extremely minor change in the final standard from the last draft standard.
00:35:18.099 -->
00:35:19.052Deirdre - And so yeah, Yep.
00:35:20.097 -->
00:35:21.335It just takes so long.
00:35:21.382 -->
00:35:25.865So yeah, we'll see if, uh, they literally just chuck CMVP out the window.
00:35:25.961 -->
00:35:38.317That's a way to update procedures or what they do, because this may be possibly the best opportunity to overhaul that program since it's come into existence, I think.
00:35:38.976 -->
00:35:39.764But, uh, we'll see.
00:35:39.860 -->
00:35:40.710We'll see how that goes.
00:35:41.451 -->
00:35:44.840David - Earlier in the year, um, I saw this talk.
00:35:45.226 -->
00:35:57.576And it was, it was kind of like the scene in The Big Short where Steve Carell's character comes and meets the guy in Vegas who's like on the other side of the trade, like selling stuff.
00:35:58.313 -->
00:35:59.052Deirdre - And they're eating sushi.
00:35:59.436 -->
00:35:59.548David - Yeah.
00:35:59.661 -->
00:36:00.414And they're eating sushi.
00:36:01.827 -->
00:36:08.947And Steve Carell's getting angrier and angrier at this guy who's basically just like taking money off the top of the trade and like fucking over his customers.
00:36:09.445 -->
00:36:13.358But you're just like, oh, like this person like actually exists.
00:36:13.952 -->
00:36:30.121And for me earlier this year, I was at this talk and there was someone who was like, just giving this talk about how important it is that when you're in a sys— system where like you need FIPS cryptography, you make sure that you're like, actually using all of the FIPS stuff everywhere, because otherwise who knows what kind of cryptography you're getting.
00:36:30.619 -->
00:36:35.527And like, it's not just enough to like get OpenSSL that lists FIPS, like other stuff might be used.
00:36:35.768 -->
00:36:42.202And the only way to know that you have like high assurance cryptography is to like make sure you have the thing that actually got like FIPS verified.
00:36:42.266 -->
00:36:44.081And I was like, oh shit, man.
00:36:44.675 -->
00:36:50.628Like, I got bad news for you about like most products you've ever used, right?
00:36:50.677 -->
00:37:06.358Like, not, not that like everyone's out here doing fraud, but just like in practice, it's not possible to get these validations, um, at a rate or reflective of every environment in the way that like all of this stuff is actually used.
00:37:06.422 -->
00:37:11.980And that's, that's why I think like CAVP makes much more sense because it's just like, let's make sure we're using the right algorithms.
00:37:12.445 -->
00:37:21.989But like the chance of you actually being able to verify to the letter of the law of how you're supposed to verify a cryptographic module is basically zero when it comes to actually distributing software.
00:37:22.389 -->
00:37:35.371Deirdre - And the argument of like, and even if you are able to do it, like the value to security, uh, is very debatable, um, about that procedure for actually like validation, um, is debatable.
00:37:35.420 -->
00:37:41.489David - And there's a they're supposed to have like a self-test of them as well, which requires like a hash of itself in it, basically.
00:37:41.489 -->
00:37:41.690Yeah.
00:37:41.690 -->
00:37:41.869Yeah.
00:37:41.869 -->
00:37:41.989Yeah.
00:37:42.050 -->
00:37:44.289Um, which then gets submitted in the cert.
00:37:44.289 -->
00:37:51.010And so like your, your, your validation only applies to like the specific, like hash of your thing, technically.
00:37:51.010 -->
00:37:58.889Um, but that is a problem of like, well, if it takes 18 fucking months to like get one of these things verified, like you're gonna make changes underneath.
00:37:58.889 -->
00:37:59.469Deirdre - Yeah.
00:37:59.469 -->
00:38:03.699Um, and so it's also, uh, you can't, you can't change like a doc comment.
00:38:03.809 -->
00:38:05.889You can't like, there's, well, depending on how you, in theory.
00:38:05.889 -->
00:38:05.909David - Yeah.
00:38:05.909 -->
00:38:09.672Deirdre - Well, that, that's not technically basically, you know, FIPS approved.
00:38:10.043 -->
00:38:15.992David - Now, most of the downstream requirements that like you don't need specifically to have that FIPS thing.
00:38:16.090 -->
00:38:37.496So like FedRAMP, for example, now lets you update, like be like, as long as you are regularly getting your cryptographic module validated whenever you make a large change, then it's fine for you to update it in between because like, you know, bug fixes are good and new features or whatever are good.
00:38:38.219 -->
00:38:42.769But like at some point, like, like what are we doing here?
00:38:43.070 -->
00:38:45.550Deirdre - Yeah, I got, I totally forgot about FedRAMP.
00:38:45.550 -->
00:38:48.869So this, this is going to impact FedRAMP, but it's not specifically named in here.
00:38:48.869 -->
00:38:56.909David - So like, I guess there's nothing specific, but yeah, well, that's just going to be downstream of like FedRAMP says you need things that are like FIPS 140-3 validated.
00:38:57.329 -->
00:39:00.309And then that now involves covering these other things.
00:39:00.309 -->
00:39:02.869So I don't think FedRAMP itself really needs to change.
00:39:03.130 -->
00:39:03.349Deirdre - Yeah.
00:39:03.349 -->
00:39:09.766David - Like, I don't know, maybe they make a, post-quantum secure statement at some point, but it'll kind of fall out of the FIPS validation.
00:39:10.806 -->
00:39:22.186Oh, personally, I like it better when there aren't a bunch of executive orders around, like my non-government job.
00:39:23.139 -->
00:39:23.623Deirdre - Yeah.
00:39:24.012 -->
00:39:24.076David - Yeah.
00:39:24.125 -->
00:39:25.369I don't know about your experience.
00:39:26.670 -->
00:39:27.672Deirdre - Yeah.
00:39:27.900 -->
00:39:30.684I don't, I, part of me is like, this could be good.
00:39:30.750 -->
00:39:33.228And part of me is just like, what, what are we doing?
00:39:33.786 -->
00:39:36.451I mean, I— yeah, I don't know.
00:39:36.675 -->
00:39:37.012We'll see.
00:39:37.237 -->
00:39:54.833Especially because it's like high-impact systems, which, for example, those might be things like the IRS's computers and the State Department systems that let it issue passports and things like that, and like help maintain consular security, stuff like that.
00:39:55.378 -->
00:40:11.139Um, so important stuff, but definitely there's going to be whole— a whole bunch of parts of the federal government that may not be PQ, um, even if everything in this EO is like, um, fulfilled all the way down to the, down to the letter.
00:40:11.893 -->
00:40:13.880Um, we'll see, we'll see how it goes.
00:40:15.032 -->
00:40:15.561I don't hate it.
00:40:16.170 -->
00:40:19.632I'm kind of amazed it does not say quantum cryptography in there.
00:40:20.065 -->
00:40:26.617David - Also, I heard someone, I heard someone references the quantum key distribution or anything like that, quantum randomness.
00:40:26.730 -->
00:40:37.175Deirdre - Thank God, like The Little Mercies, because there's been chatter, more chatter about that, I think because there's funding coming out of like the EU or something for EU-based businesses.
00:40:37.288 -->
00:40:40.242And it's just like, no, no, no, we don't want none of that.
00:40:40.840 -->
00:40:41.534I was having to— you—.
00:40:41.891 -->
00:40:43.893David - Is a great place to take vacation.
00:40:46.588 -->
00:40:47.347Deirdre - There's nothing about—.
00:40:47.347 -->
00:40:49.369David - This is a great place to host a World Cup, apparently.
00:40:49.903 -->
00:40:53.931Deirdre - Um, Boston is a great place to host any Scotland matches.
00:40:54.190 -->
00:41:06.963Um, I am sad that I was not spending as much time in Boston while, you know, every Scots person, Scottish person, um, that could ambulate made it to my hometown for a week.
00:41:07.619 -->
00:41:09.143But, uh, I want them to come back.
00:41:09.385 -->
00:41:13.938Now the English are over there and everyone's like, boo, we want the Scottish back.
00:41:14.677 -->
00:41:17.355David - English historically haven't had a great time in Boston.
00:41:17.788 -->
00:41:20.369Deirdre - No, it was— yeah.
00:41:21.608 -->
00:41:29.206Um, I swear someone said that there was a mention of investment in quantum computing, but it's definitely not in this EO.
00:41:29.288 -->
00:41:30.226Did I miss another one?
00:41:30.597 -->
00:41:34.670Or maybe, maybe Trump was saying the wrong things out of his mouth again.
00:41:37.681 -->
00:41:41.264David - So, um, there is about that as well.
00:41:42.019 -->
00:41:43.980Deirdre - Hold on, I'm pasting it in here.
00:41:44.204 -->
00:41:46.652Yes, there was another one, another presidential action.
00:41:47.710 -->
00:41:59.407Um, gosh, ushering in— I'm sharing— ushering in the next frontier of quantum innovation.
00:42:00.550 -->
00:42:00.791David - How long?
00:42:00.889 -->
00:42:01.487Deirdre - It's not this one.
00:42:01.617 -->
00:42:03.284This is on— it's not that long either.
00:42:03.414 -->
00:42:05.016David - No, so there's a second EO.
00:42:05.436 -->
00:42:05.744Deirdre - Yeah.
00:42:06.782 -->
00:42:09.782David - Um, oh God, two EOs in one show.
00:42:09.864 -->
00:42:11.396I think that, that might be a bit much.
00:42:12.777 -->
00:42:14.389Deirdre - I'm scanning, scanning, scanning.
00:42:14.893 -->
00:42:16.536Updating quantum strategy.
00:42:18.811 -->
00:42:21.134Harnessing quantum computing for science.
00:42:22.679 -->
00:42:36.547Secretary of War and a bunch of other secretaries shall ensure that capabilities, manufacturing infrastructure, and expertise are made available to support this QC effort.
00:42:43.007 -->
00:42:43.411David - Exploration.
00:42:43.476 -->
00:42:47.273Deirdre - Coordinate with the NASA administrator, the director of NSA.
00:42:49.277 -->
00:42:57.956David - Uh, to attempt to like keep track of the relative capabilities of different quantum computing systems in order to accurately assess the performance.
00:42:58.449 -->
00:43:07.500That's interesting because it's really hard to assess relative capabilities of them cuz they all work different ways and basically none of them do anything useful until one day.
00:43:07.976 -->
00:43:09.559One of them will do many things useful.
00:43:09.994 -->
00:43:22.206Deirdre - All of a sudden they do a whole bunch of— a whole bunch of useful, uh, Secretary of Energy shall, uh, basically price out and scope out delivery for one QC.
00:43:23.545 -->
00:43:24.400Cool.
00:43:27.496 -->
00:43:33.759Um, develop a plan to encourage contributions to the effort from commercial quantum computing companies.
00:43:35.563 -->
00:43:42.567Secretary of War, national security applications of quantum computing, establish a center for such a purpose.
00:43:44.679 -->
00:43:45.034David - Thought, thought, thought.
00:43:45.181 -->
00:44:01.688I previously heard of NSA saying that they like to be approximately 7 years ahead in terms of the, like, general public in terms of cryptanalysis, which I know some people have taken to, well, that means they clearly have a quantum computer now.
00:44:02.092 -->
00:44:03.157I think that's a load of crap.
00:44:03.222 -->
00:44:04.014There's like no way.
00:44:04.583 -->
00:44:07.826Yeah, that anyone has a quantum computer now.
00:44:08.275 -->
00:44:11.871Um, like, we would— there would be downstream effects of that.
00:44:11.952 -->
00:44:25.342Deirdre - Yes, it's, it's sort of like when, um, all the nuclear scientists just stopped publishing for a while when, like, most of them were either working at the— at Los Alamos, uh, or, you know, some of them were working in Germany.
00:44:26.161 -->
00:44:39.829Um, it's just like the absence, uh, is a signal, and we we don't have anything close to that, or, or the inverse of sort of like, um, we would see evidence, uh, even, even if it's not direct evidence.
00:44:40.440 -->
00:44:50.018David - We would also need like technological advances that would probably see like effects of an industry that like don't seem to have happened, like, you know, improvements in superconducting and things like that.
00:44:50.422 -->
00:44:50.682Deirdre - Yep.
00:44:51.719 -->
00:44:56.206David - Um, but speaking of building quantum computers, do you want— should we talk about ECDSA.fail?
00:44:57.525 -->
00:44:58.072Deirdre - Oh my goodness.
00:44:58.119 -->
00:44:59.177David - I love a good.fail domain.
00:44:59.692 -->
00:44:59.931Deirdre - Yeah.
00:45:00.172 -->
00:45:05.980Um, yeah, that's good before, uh, we, yeah, you get the gist of the rest of the CEO.
00:45:06.059 -->
00:45:11.208They're actually kind of like trying to tell people to do stuff regarding quantum computing, which is pretty cool.
00:45:12.043 -->
00:45:14.193Um, we'll see where that goes.
00:45:14.929 -->
00:45:38.175Um, so we, we discussed how, um, there were published, uh, improvements, uh, to attacking Elliptic curve discrete logarithm problem, uh, with quantum attack algorithms, which are basically like iterations around Shor's algorithm or improving parts of some of these like broad class attack algorithms.
00:45:38.592 -->
00:46:06.661And specifically, the Google, uh, Google folks published a paper that claimed they had a quantum attack circuit for one of the, uh, slowest parts of, uh, running Shor's algorithm to attack, uh, this discrete— elliptic curve discrete logarithm problem, which I think it was literally like the elliptic curve point operations itself, which is like funny because that's the classical part.
00:46:07.175 -->
00:46:20.581And it turns out running it on the quantum computer is actually kind of like the slow bottleneck of using Shor's algorithm to attack the thing, to find that like the periodicity of your, you know, elliptic curve group or whatever it may be.
00:46:21.206 -->
00:46:39.679Um, so they claim— they published a paper that claimed that they were able to do this in, you know, n million Toffoli— I think it was like a million and change Toffoli, um, gates, which is like a way to measure the circuit depth of the, uh, quantum circuit that you're actually going to use.
00:46:39.742 -->
00:46:48.987It's kind of like measuring the number of multiplies or divides or whatever you might have in a certain attack algorithm or another, another algorithm on a classical computer.
00:46:49.083 -->
00:46:51.246It's just a way to kind of like measure.
00:46:51.807 -->
00:47:01.911And then, um, I think they claimed that they needed like, you know, a 1024, some, some small number of logical qubits or whatever.
00:47:02.472 -->
00:47:07.427Not— they didn't, they didn't require like 10 million or a million logical qubits to run this.
00:47:07.539 -->
00:47:10.233It was some, some small number or something like that.
00:47:11.130 -->
00:47:14.643Um, but they did not publish the circuit.
00:47:15.235 -->
00:47:34.766They published a zero-knowledge proof of the circuit statement and they published the proof and they published their claims about the size and the speed that this should take to attack, you know, elliptic curve, uh, sorry, uh, elliptic curve DSA, uh, algorithm, uh, based on P-256 curve.
00:47:35.054 -->
00:47:35.150Yeah.
00:47:35.536 -->
00:47:36.034Um, yeah.
00:47:36.130 -->
00:47:42.443David - The Google publication was 2.1 million gates and 1,425 qubits.
00:47:42.878 -->
00:47:43.103Deirdre - Nice.
00:47:43.248 -->
00:47:43.842I was pretty close.
00:47:43.889 -->
00:47:44.918David - In March, late March.
00:47:46.403 -->
00:47:47.030Deirdre - 2024.
00:47:47.112 -->
00:47:48.028David - Um, excuse me, 2026.
00:47:48.768 -->
00:48:11.878Deirdre - And this, this was kind of interesting because two people have been following quantum attack algorithms and, and sort of like, this is part of a, um, lineage of like, here's our improvement and here's like our tweak on how, how many resources, how fast can we get some of these attack algorithms to be.
00:48:12.541 -->
00:48:15.603Even though we don't have a quantum computer yet to really, you know, test them.
00:48:15.748 -->
00:48:17.496Like, this is— I'm going to write it up or whatever.
00:48:18.056 -->
00:48:24.918But this was new in that the authors claimed that their results were too dangerous to publish.
00:48:25.543 -->
00:48:35.690So that is why they published a zero-knowledge proof of them, and they directly compared it to, um, uh, to— I think it was literally like the Manhattan Project or whatever.
00:48:35.931 -->
00:48:42.889Like, they didn't want to, like, publish the ingredient, like, the specific ingredients of how to make an atomic bomb or something like that.
00:48:43.257 -->
00:48:48.528And it's just like, uh, like, I don't know, like, we can't run it yet, can we?
00:48:48.625 -->
00:48:51.646Like, it's gonna be several years until we can— until we can run it.
00:48:52.159 -->
00:48:53.592So like, all right, whatever.
00:48:54.494 -->
00:48:55.572But that's not the funny part.
00:48:55.862 -->
00:49:06.539That, that was an interesting kind of— it, it caused a little bit of a debate of like, oh my goodness, if we make any more improvements of attack algorithms, do we have to— is this the way we disclose them now?
00:49:06.829 -->
00:49:08.913Is this a new form of responsible disclosure?
00:49:09.010 -->
00:49:10.076Like, blah, blah, blah, blah.
00:49:11.454 -->
00:49:12.239That didn't matter.
00:49:12.496 -->
00:49:18.882People saw this result and they're like, ooh, you're trying to attack the, the signing algorithm of Bitcoin.
00:49:19.474 -->
00:49:22.331Hmm, let's try if we can like really run this down.
00:49:22.507 -->
00:49:48.130And someone set up ECDSA.fail, and they were basically— they basically started crowdsourcing, um, attempts to improve this, uh, theoretical construction, uh, you know, this construction published by Google, but without publishing the actual circuit, and tried to beat their claimed, um, uh, costs and speed and resource requirements.
00:49:48.802 -->
00:49:59.378And people were using ChatGPT and Claude and Opus and all this stuff to try and incrementally try to improve and improve and improve and improve and submit it.
00:49:59.876 -->
00:50:06.751And the zero-knowledge proof turned out to be a great way to like cross-test your results or something like that.
00:50:07.007 -->
00:50:08.418I think that's what it was.
00:50:09.076 -->
00:50:10.534One, there was also a bug in it.
00:50:10.934 -->
00:50:17.074The Trail of Bits people were able to find that, like, you, they were able to get it to validate things that it was not supposed to validate.
00:50:17.507 -->
00:50:18.197Was that it?
00:50:18.630 -->
00:50:21.643And that, that's what they were using to, to validate other things.
00:50:22.317 -->
00:50:22.782I don't remember.
00:50:22.862 -->
00:50:35.114David - Um, no, they're, they're using the, just the same, like, sim circuit simulators that, um, were in the Google paper, but then like Uh, the Google paper didn't include like the actual circuit that just had like a proof about the circuit.
00:50:35.612 -->
00:50:36.094Yeah.
00:50:36.751 -->
00:50:38.853But like the circuit simulator is basically just code.
00:50:38.918 -->
00:50:40.507And so you can have a coding agent, you know?
00:50:40.588 -->
00:50:40.668Deirdre - Yeah.
00:50:40.748 -->
00:50:41.164Okay.
00:50:41.230 -->
00:50:41.952That was, that was it.
00:50:42.112 -->
00:50:43.925David - Optimize this circuit, make no mistakes.
00:50:44.375 -->
00:50:44.760Deirdre - Yep.
00:50:45.402 -->
00:50:47.873And it took 3 days.
00:50:48.146 -->
00:50:50.842Let me see if I can find, if I can cross-reference.
00:50:50.956 -->
00:50:57.746I think this was the 30th and the first result that beat it was June 2nd.
00:50:57.795 -->
00:51:13.706So I think it was 3-ish days before the entire point of this thing is too dangerous to publish, so we're just going to publish a zero-knowledge proof on it, which is completely blown out of the water by people crowdsourcing competing results on the internet.
00:51:14.092 -->
00:51:16.056And they're still going, and they've been able to drive it down.
00:51:18.460 -->
00:51:28.576It's like not quite twice as fast or twice as efficient in terms of gates as the Google, uh, results.
00:51:29.056 -->
00:51:42.003But it's very— it— people have been able to get a very good, um, much better, like 45% less gates and like, yeah, uh, 25% less—.
00:51:42.532 -->
00:51:48.155David - Or excuse me, 25% or 30% less gates and like 45% less qubits.
00:51:48.605 -->
00:51:48.860Yeah.
00:51:49.648 -->
00:51:52.329Deirdre - And, uh, uh, it's, it's a lot of fun.
00:51:52.635 -->
00:51:54.047It, it's a, it's a lot of fun.
00:51:54.496 -->
00:52:00.358David - So, um, power of telling people, it's, it's telling people that like something can be done and then trying to figure it out.
00:52:00.422 -->
00:52:10.217Like, uh, when, when DROWN happened, like the way we got involved at Michigan was we heard there was a rumor that like there was something wrong with SSLv2.
00:52:10.539 -->
00:52:19.579And so because we heard that, myself and my advisor like opened up the OpenSSL source code and just looked at the SSLv2 handshake for a while, like on a projector screen.
00:52:19.949 -->
00:52:23.639And then we were like, ah, that pointer's wrong after a while.
00:52:23.639 -->
00:52:24.699And that was like our contribution.
00:52:25.260 -->
00:52:28.329That turned out a bunch of people much smarter than us had come up with like a cryptographic vulnerability.
00:52:28.579 -->
00:52:30.289And we were just like, no, that pointer's wrong.
00:52:31.179 -->
00:52:35.079And those two combined are what like led to the fan— the fanciest version of Ground.
00:52:35.079 -->
00:52:40.190But like the only reason that we thought to look there was someone said, well, someone said, the rumor was there was something there.
00:52:40.980 -->
00:52:41.619Same with this.
00:52:41.619 -->
00:52:44.880Once you know something can be beaten, well, let's go, let's go try it.
00:52:44.880 -->
00:52:45.199Deirdre - Yeah.
00:52:45.199 -->
00:52:49.780David - Or just the same as like, uh, Nicholas Carlini, you know, saying the vulnerability is probably in this function.
00:52:50.791 -->
00:52:50.969Yeah.
00:52:51.032 -->
00:52:51.641Go, go find it.
00:52:51.898 -->
00:52:53.005No, it's in this function.
00:52:53.181 -->
00:52:55.811Like, once you know the vulnerability is in the function, then you can find it.
00:52:55.907 -->
00:52:58.137But yeah, otherwise you'd never find it.
00:52:59.130 -->
00:53:00.092Deirdre - Gosh, I love it.
00:53:00.318 -->
00:53:02.273Um, I'm amused.
00:53:02.980 -->
00:53:08.159I kind of hope that, like, this is, this is a great way to get improvements.
00:53:08.512 -->
00:53:14.541Like, their attack algorithms, like, okay, but like, that's how, that's how defenses get better because the attacks get better and then we get better at defending.
00:53:14.606 -->
00:53:16.610So that means you migrate off of ECDSA.
00:53:16.867 -->
00:53:23.074David - Spoiler alert, but, um, or, you know, a little culture clash between the physicists and the software security people.
00:53:23.409 -->
00:53:23.731Deirdre - Yes.
00:53:24.132 -->
00:53:38.226Um, that, that was a thing that may not be obvious from just looking at the papers and the blog posts was that those results for that attack algorithm actually came out of like a different part of Google than say cryptography and security.
00:53:38.885 -->
00:53:45.847And only the cryptography and security people found out about this thing that was coming, like very last minute, as far as I know.
00:53:46.746 -->
00:53:48.335And like, they're just like, what?
00:53:48.447 -->
00:53:49.427Like, wait, what?
00:53:49.733 -->
00:53:55.047Like, what do you— and then it was a whole negotiation of trying to get it out of Google.
00:53:55.577 -->
00:54:00.699There's no NSA or US government meddling, being like, no, no, you can't publish this, it's too dangerous.
00:54:00.795 -->
00:54:04.280Like, none of that, as far as— that's everything I've learned.
00:54:04.344 -->
00:54:21.440It's just like people, these physicists spooked themselves And instead of working with security people and cryptography people who are used to publishing, you know, things that affect security postures out in the world, they just spooked themselves.
00:54:21.489 -->
00:54:22.996They said, I don't know if we should publish this.
00:54:23.251 -->
00:54:25.960Oh, let's go get a zero-knowledge proof to slap on it.
00:54:26.057 -->
00:54:27.789That, that'll let us get it out the door.
00:54:28.943 -->
00:54:36.460David - So, um, yeah, I mean, Scott Aaronson even had a blog post kind of about this where he was like, you know, maybe like we shouldn't publish some of this stuff cuz we're close.
00:54:36.637 -->
00:54:39.539And then he was like, Nadia Henninger talked me out of it on Facebook.
00:54:39.619 -->
00:54:40.677And I thought that was interesting.
00:54:40.710 -->
00:54:42.936Because I didn't realize Nadia was still on Facebook.
00:54:43.427 -->
00:54:44.148Deirdre - Oh my goodness.
00:54:45.297 -->
00:54:46.494I, I didn't—.
00:54:46.494 -->
00:54:51.153David - But you know, thank you to Nadia for keeping your Facebook so that you can like tell Scott Aaronson when he's wrong.
00:54:51.655 -->
00:54:51.784Yes.
00:54:52.463 -->
00:54:56.570Deirdre - Uh, thank you very much because I'm not going on Facebook.
00:54:58.061 -->
00:55:07.730And what I wonder— oh, I wonder, I think his blog posts are, or the, the comment section are, are cross-synchronized, uh, with, with Facebook.
00:55:07.875 -->
00:55:08.532That might be why.
00:55:08.757 -->
00:55:09.079I don't know.
00:55:09.143 -->
00:55:09.463David - I don't know.
00:55:09.641 -->
00:55:11.519Deirdre - Well, I haven't logged into Facebook in many years.
00:55:11.615 -->
00:55:15.309David - Thank you to Nadia Henninger for discussing this with Scott Aaronson.
00:55:15.742 -->
00:55:15.998Deirdre - Yeah.
00:55:16.465 -->
00:55:17.942But yeah, easy to say it's fun.
00:55:18.295 -->
00:55:28.331Uh, go, go fork the, the circuit simulator and see if you can do better with your favorite, uh, on your own or with your favorite, uh, large language model or something, because apparently they're good at it.
00:55:29.005 -->
00:55:29.422Seems fun.
00:55:30.514 -->
00:55:30.755Cool.
00:55:31.429 -->
00:55:32.248Did we miss anything?
00:55:34.610 -->
00:55:37.981David - I think that's enough, uh, executive orders for 10 PM on a Tuesday.
00:55:38.384 -->
00:55:44.054Deirdre - Yeah, I don't want to discover any new, uh, Trump EOs that involve quantum or cryptography or security.
00:55:44.791 -->
00:55:45.820Um, cool.
00:55:46.237 -->
00:55:47.507Yay, emergency pod done.
00:55:48.197 -->
00:55:53.032Security cryptography whatever is a side project from Deirdre Connolly, Thomas Ptacek, and David Adrian.
00:55:53.320 -->
00:55:54.413Our editor is Nettie Smith.
00:55:54.990 -->
00:55:56.420You can't— oh my God, I need—.
00:55:56.773 -->
00:56:00.307David - Fuck, is our editor Nettie Smith?
00:56:00.371 -->
00:56:01.159Like, we keep editing ours.
00:56:01.735 -->
00:56:03.965Deirdre - Uh, yeah, I need the fucking—.
00:56:03.998 -->
00:56:05.409David - I need to find this online.
00:56:05.762 -->
00:56:10.155Yes, @tqbf, um, @durumcrustulum or @dadrian.
00:56:10.813 -->
00:56:13.925Yes, that's right, I ponied up the money to change my handle.
00:56:14.565 -->
00:56:17.019Deirdre - Oh, it's not David C.
00:56:14.565 -->
00:56:17.019Adrian no more.
00:56:17.869 -->
00:56:26.994David - All right, don't forget to like us, rate us, smash that like and subscribe, follow us on whatever preferred format you get your podcasts or video podcasts.
00:56:27.561 -->
00:56:27.722Deirdre - Yes.
00:56:27.802 -->
00:56:29.565David - And thank you for listening.
00:56:30.001 -->
00:56:33.543Deirdre - And also you can get merch at merch dot securitycryptographywhatever dot com.
00:56:33.722 -->
00:56:34.659Thank you for listening.
