pull down to refresh
how do you think about the risks of using some of these fairly new cryptographic techniques?
The fundamental problems like the endomorphism ring problem are fairly well studied. Not as well-studied as the EC discrete log problem we rely on today but still, I think if isogeny-based schemes are broken, they'll be broken one at a time, by flaws in their security proofs rather than by flaws in the underlying core assumptions of the field.
PRISM is an interesting case study. They have a curious security proof. They make the assumption that it's hard to find prime degree isogenies from an arbitrary curve.
It just so happens that if producing prime-degree isogenies from an arbitrary curve was easy, it would prove SQIsign secure because SQIsign assumes the existence of prime-degree isogeny oracles in their security proofs. So if SQIsign is broken, this would prove no such oracles exist, and that PRISM's assumption is secure. Vice versa, if a prime-degree isogeny oracle does exist it would break PRISM but prove SQIsign secure.
I've heard one of their authors refer to this as "security by common belief". This doesn't necessarily mean that only one OR the other is secure. It's possible that both are secure, but no one knows how to prove it rigidly yet.
Would you feel comfortable using them for Bitcoin in the next year or two (if there was lots of time and energy put into it) or would you want to wait longer?
Personally I see isogeny crypto as a long-term replacement to consider in maybe 10 years or more, not something that should be rushed into consensus.
i don't think waiting is the right thing to do either though. We as a community should be investing in research that shows promise, tech that may play a role in our future. Right now that's what i'm trying to do with my time, and i hope others will join me in that effort so that someday we can still do fun stuff on top of bitcoin's cryptography even after QCs come around.
I had to look up isogeny and then I had to look up surjective, but I appreciate you taking the time to write the article.
I am sure this is a difficult question to answer, but how do you think about the risks of using some of these fairly new cryptographic techniques? Would you feel comfortable using them for Bitcoin in the next year or two (if there was lots of time and energy put into it) or would you want to wait longer?