4

I understand that quantum computers are many orders of magnitude faster than today's binary computer and that this is expected to enable decryption that was unlikely (it would take too long) with today's binary computers.

That being said, how would the Quantum-computer speed-advantage render the username/password security of a home-router's SSH port ineffective?

Mike Ounsworth
  • 57,707
  • 21
  • 150
  • 207
gatorback
  • 1,541
  • 2
  • 12
  • 17

2 Answers2

10

Quantum computer misconceptions

First, I think you misunderstand quantum computers. They are a hard and non-intiutive concept, so I don't blame you. Let me try to clear things up.

Metaphor: GPUs are exceptionally good at computations involving matrices (aka linear algebra) and therefore excel at problems that parallelize well. At any other type of problem (computing pi, for example) they are much slower than CPUs.

Quantum computers are exceptionally good at computations involving waves, and therefore excel at problems with repetitive or periodic structures. There is a surprisingly small number of things that quantum computers are good at, but it just so happens that all the public key algorithms we use today (RSA, DSA, DH, and ECC) are in this category. Generally speaking, hashes and symmetric ciphers like AES are not vulnerable to QC's.

The statement that "quantum computers are faster than binary computers" is, except for a select type of problems, wrong.

Offline Brute-force

Here the attacker has a copy of the of the hashed password(s) and is trying to guess the plaintext password(s) (aka hash pre-images). Quantum computers are not very good at breaking hashes; but if you load the hash value into the qubit register, you can use Grover's algorithm to get a sqrt(n) speedup, essentially reducing a 128-bit hash to 64 bits, a 256-bit hash to 128 bits, etc. Assuming passwords are hashed with a 256-bit hash function, you're good. So if your users chose strong passwords (aka randomly generated), then guessing is still centuries or millennia, even with a quantum computer. Assuming your users chose weak easy to guess passwords, then QC's also don't make a difference because you'll crack it in under a minute on a regular GPU rig. So quantum computers don't really make a difference for offline brute-force attacks.

Online brute-force

Here you are submitting guesses to a live login server. Since the attacker doesn't know the password hash to feed into a quantum computer, you have nothing to run Grover's on. Besides, the 5 guess-per-secand rate-limit and IP banning done by the server is the bottleneck here, not the size of your processor. So quantum computers make no difference for online brute-force attacks either.

Key-Based SSH

You specifically asked about username/password, but I'll borrow from @Trickycm's answer. If your SSH server is using RSA keys rather than passwords, then it's a different story and against a quantum adversary you get something like "weak passwords" < "RSA keys" < "32 char random passwords" (depending a bit on which symbol set you're generating passwords from, and the size of your RSA keys).

Mike Ounsworth
  • 57,707
  • 21
  • 150
  • 207
1

If it is an online username/password auth system quantum computing has little to no advantage as bandwidth and endpoint processing power becomes the bottleneck. The endpoint server could not keep up with the rate of attempts.

If however you are using public private keys for anything you would have an issue as you could derive the private key from the public. This is a huge problem for both online and offline systems.

If your routers ssh auth was based on keys, then you could be compromised.

Obviously this is a high level answer as there are many variables out with the computing power needed to crack a key pairing.

TrickyDupes
  • 2,809
  • 1
  • 13
  • 27
  • I think this is too vague to be useful. There is not a single quantum computing system in use around the world that can actually derive a private key from a public key, nor do I expect there will be for many years yet. Declaring something to be possible without mentioning the many very large caveats is simply misleading. – Conor Mancone Nov 27 '17 at 17:40