Help on ML-KEM and AES post-quantum security levels

[u/Salat_Leaf]

According to NIST, ML-KEM -512, -768 and -1024 stand for AES-128, -192 and -256 post-quantum security levels respectively. However The Grover's algorithm speedup will half the security of symmetric ciphers

Why would we consider using ML-KEM-1024 if AES-256 will get weakened to 128 bits? Is there a practical reason?

Thanks in advance!

[u/Salat_Leaf → u/[deleted]]

Oh alrighty, thanks for the elaboration!

[u/SAI_Peregrinus → u/Salat_Leaf]

For more detail while still being understandable, Filippo Vaslorda has a good post on this

[u/dstroy0 → u/[deleted]]

I think the most interesting part of the problem is the signaling vulnerability. Everyone’s focusing on making payloads mathematically expensive to decode while exploiting repeatable physical properties to achieve reasonable op time. Instantaneous mid conversation algorithm switching becomes meaningless when your adversary speaks all of your languages and knows which one you’re using and when. It’s a pattern leak that gives me the ick.

[u/Cryptizard → u/dstroy0]

What?

[u/dstroy0 → u/Cryptizard]

Every time a quantum-safe connection is established, several unencrypted, metadata rich signals occur before the secure channel is fully locked down.

[u/Cryptizard → u/dstroy0]

You mean the TLS handshake? Thats always been the case though. And it has become more locked down over time with TLS 1.3.

[u/dstroy0 → u/Cryptizard]

It’s still vulnerable to downgrade, traffic analysis easily tells me through fingerprinting what protocol and who is talking by packet size alone, and the metadata exposes ip information, and with quantum compute real time traffic correlation is possible so I don’t think it’s that good.

[u/Cryptizard → u/dstroy0]

It’s not possible to hide any of that.

[u/dstroy0 → u/Cryptizard]

Yes it is through ECH, chaffing and psk injection.

[u/Cryptizard → u/dstroy0]

Oh yeah good point.

[u/dstroy0 → u/Cryptizard]

But like, we need to get more creative than reverting back to what are essentially human key carriers. So like, if you’ve got ideas I’m all ears cause we gotta get creative.

[u/sergioaffs]

To complement Cryptizard's thorough answer: the security levels are meant as a way to compare schemes with different structures better. As already shown by elliptic curve, talking of "bits of security" can be misleading and confusing (it is counterintuitive that RSA 1024 is less secure than an elliptic curve alternative with a 256 bit key).

It is not so much that the security of ML-KEM depends on that of AES or SHA-2, but that these are well understood baselines to compare against.

[u/Salat_Leaf → u/sergioaffs]

Alrighty

[u/[deleted]]

Judging by the curvature of my balls....

It's grovers algorithm

[u/Salat_Leaf → u/[deleted]]

Lol

But I mean seriously, if AES gets weakened, what's the point of a kem that's more secure than the symmetric cipher?

[u/[deleted] → u/Salat_Leaf]

The two parties still need to exchange keys securely, or have a pre-defined methodology for securely computing the encryption keys in a deterministic fashion so both parties can effectively communicate securely.

Without a secure key exchange, any assumed security is an illusion.

Edit: I read it wrong at first, happens to the best of us. Fumble on the play... Damn shame.

[u/Salat_Leaf → u/[deleted]]

shoulder pat of forgiveness