Chasing Cyber - #25 - Stronger Together

TLS performance, beautiful code, and the death of a business model

Post-Quantum TLS Performance Paper

Amazon just published a paper on PQC performance in TLS 1.3. The results are promising!

With good network conditions, there is a 5% impact of switching to post-quantum algorithms. In less ideal conditions, where stability or bandwidth is lower, the impact is 10-15%.

Uniquely, this research considered total data transfer time, rather than the initial TLS handshake. I prefer this approach because it mimics real-world concerns. Nobody cares about handshake speed. They care how long it takes to fling 200KB across their network.

Papers like this make me feel confident about the path ahead. In most settings, small overheads of 5-15% are not going to impact our lives.

Read the paper here: https://eprint.iacr.org/2024/176.

---

Launch of the Post-Quantum Cryptography Alliance

“We implemented some PQC algorithms” was never going to be a long-term software business model. And now the end has come.

The Linux Foundation just launched the Post-Quantum Cryptography Alliance, which seeks to be “the central foundation for organizations and open source projects seeking production-ready libraries”.

The founding members include Google, AWS, Cisco and IBM. Given this critical mass of big players, I expect the PQCA will become the leading open-source community for quantum-safe algorithm implementations.

The University of Waterloo, another founding partner, has contributed its Open Quantum Safe project to the PQCA. Open Quantum Safe has been a bedrock of the PQC community for years, thanks to its high-quality implementations and convenient plugins for software like OpenSSL.

Despite this announcement, there’s plenty of opportunity for vendors who specialise in hardware implementations of PQC algorithms. But for those who peddle non-descript software with the only differentiator being PQC algorithms, the future looks bleak.

---

Kyber in 500 Beautiful Lines of Code

Kyber in 500 lines of code and actually readable 🙌

I don’t often delve into the nuts and bolts of algorithm implementation, but I was inspired by the recent work of Filippo Valsorda. Filippo was the head of cryptography for the Go team at Google and is now a professional open-source programmer.

He wrote an implementation of ML-KEM (f.k.a Kyber) in the Go language, straight from the FIPS-203 draft standards. It is remarkably readable, concise, and somewhat performant.

You can read his blog about the topic, but here are my takeaways:

• Readability will pay dividends for years to come. Security bugs are nasty, and we all need code that is clear and concise.

• The specs work! Filippo didn't refer to the reference implementations and worked straight from the FIPS-203 draft specs.

• Exhaustive testing needn't bloat the code base. In another 650 lines of code, 95%+ code coverage was achieved.

I might have to fire up the text editor and write some Go code! I miss it.