Prof Bill Buchanan (ASecuritySite)

The following article: https://medium.com/asecuritysite-when-bob-met-alice/go-and-do-crypto-1…

RSA may well be be deprecated long before quantum computing can break it. Post-quantum cryptography standards are already being deployed: GnuPG 2.5 has introduced support for Kyber (ML-KEM, FIPS-203). Kyber is added in in OpenSSH 9.9 (September 2024) as a hybrid post-quantum key exchange algorithm and made the default key exchange mechanism in OpenSSH 10.0 (April 2025). The implementation uses a hybrid approach, combining classical cryptography (X25519) with ML-KEM-768 for key exchange (mlkem768x25519-sha256). OpenSSH plans to add support for post-quantum signature algorithms in the future. OpenSSL 3.5.0 (April 2025) supports ML-KEM, ML-DSA and SLH-DSA. https://medium.com/asecuritysite-when-bob-met-alice/a-long-goodbye-to-… The missing context in the post by John is an exposition of why progress has been slow - decoherence and error rates - and what the rate of progression can be when these obstacles have been resolved. Shor's algorithm requires fault-tolerant quantum computing, which didn't exist in any form until recently. Tphysical error rate must be lower than the threshold required. Different research groups and companies, using various qubit technologies have already demonstrated techniques and elements of below-threshold error correction. https://www.nature.com/articles/s41586-024-08449-y

> I know of no single incident of SHA-256 or SHA-3 having collisions successfully generated. That's fine, I don't expect you to believe me without evidence. But I have seen this happen more than once in my work. > you are relying on someone having selected a weak password Stated another way, you are relying on having some idea of what the original data looked like, so you can reduce the search space. Absolutely correct. However, if you're hashing public records like real estate, where you literally have the clear text, that's a much simpler problem than cracking passwords. All you need to do is alter the document in the way that you want, then find what other changes are needed to create a collision with the original hash. This is not very computationally intensive compared to password cracking. Add in that the amount of money on the line with real estate can be high enough that it would make it worth throwing serious resources at it -- more than the average password cracker could even begin to summon -- and my confidence in the security of the hashes is greatly reduced. Here's an interesting general overview of the problem: https://medium.com/asecuritysite-when-bob-met-alice/can-i-create-a-has…

The method for the BA hack was not from javascript hosted externally. See https://medium.com/asecuritysite-when-bob-met-alice/the-british-airway…

> but tools like SRI and CSP stop these attacks dead in their tracks. this isn't... usually true. in the case of this attack, the Javascript was appended directly to a 'known good' library resource[1]. Typically CSP whitelists based on origin, which would make CSP ineffectual in this case. Also, websites like BA have advertising, and it's nearly impossible to run CSP with ads unless you use the `strict-dynamic` directive, which whitelists any javascript loaded by your javascript recursively... including this javascript[2]. There are other, more uncommon modes for CSP which you might be referring to: 1. Nonce, which provides protection by ensuring each script has a server-calculated one-time-use token. This would not have any effect, as the script is part of one naturally loaded by the server. 2. Hash[2], which provides protection by checking the script's content against a predetermined hash. This possibly could be effective, but in practice rarely is. If the attackers could edit this script, there's absolutely no reason to believe either (1) this just updates the generated hash or (2) the attackers cant just update the hash. (this is essentially the same as SRI). Hash is potentially effective where taking advantage of a third-party CDN with known content that should not change, but by the look of the url: http://www.britishairways.com/cms/global/scripts/lib/modernizr-2.6.2.m… the resource was not on a CDN. [1]:…