- nexa - server-nexa.polito.it

Fwd: [DigHum Lecture Series] Next talk on Feb. 8: Daniel Samaan on "Job Scenarios 2030"
by Enrico Nardelli Feb. 1, 2022

Feb. 1, 2022

-------- Messaggio Inoltrato -------- Date and time: *Tuesday, Februar 8, 2022 at 5:00 p.m.* (17:00) Central European Time (UTC+1) Topic: *“Job Scenarios 2030: How the World of Work has Changed Around the Globe”* (scroll down for abstract and CV) Speaker: *Daniel Samaan * (International Labour Organization) Moderator: *George Metakides* (President of the Digital Enlightenment Forum) To participate via *Zoom* go to: https://tuwien.zoom.us/j/96389928143?pwd=UU5YRkNuRmdoWHV4MFBwMWRCcUErdz09 (Password: 0dzqxqiy) The talk will be live streamed and recorded on our *YouTube* channel: https://www.youtube.com/digitalhumanism For further announcements and information about the speakers in the Lecture Series, see https://dighum.ec.tuwien.ac.at/news-events ----- *ABSTRACT:* We are in the year 2030. How will the world of work look like in 2030? Based on today’s megatrends artificial intelligence (AI), climate change, population aging and others, the author develops scenarios for possible Futures of Work in different regions of the world: Robots have not replaced humans but AI and smart machines have become indispensable parts of our working lives. Efforts to mitigate climate change may fail but still trigger an ecological transformation that leads us into a more sustainable future. Mass production might enter its last decades but people may instead work in small shops and in more agile organizations. Can we work without jobs? In all these transformations AI and the digitalization are likely to play crucial roles. Whatever the future will be in 2030, thinking through such scenarios helps us perceiving opportunities and risks today, and shape the Future of Work that we want. *Short Bio of Daniel Samaan:* Daniel Samaan is an Economist and Senior Researcher at the International Labour Organization (ILO) in Geneva. He is an expert in the analysis of global labour market trends, specialized in the links with globalization, new technologies/AI, sustainable development, and a new work culture. He has been an author and part of the core teams of several ILO reports. His research has been published in peer-reviewed journals and he is a regular public speaker on various labor market topics and on the Future of Work. Daniel previously worked at the economic policy research center, SCEPA, and in the consulting industry in New York City. He holds a PhD in economics from the New School for Social Research in New York and a master’s degree in economics and business administration from the University of Passau in Germany. ----- For further announcements and information about the speakers in the Lecture Series, see https://dighum.ec.tuwien.ac.at/news-events Also, please note that you can access the slides and recordings of all our past events via that link. Sign the Vienna Manifesto: https://dighum.ec.tuwien.ac.at Follow us on Twitter @DigHumTUWien ===================================================================== Prof. Enrico Nardelli Dipartimento di Matematica - Universita' di Roma "Tor Vergata" Via della Ricerca Scientifica snc - 00133 Roma tel: +39 06 7259.4204 fax: +39 06 7259.4699 mobile: +39 335 590.2331 e-mail:nardelli@mat.uniroma2.it home page:http://www.mat.uniroma2.it/~nardelli blog:http://www.ilfattoquotidiano.it/blog/enardelli/ http://link-and-think.blogspot.it/ ===================================================================== --

1 0

148° Mercoledì di Nexa | 9 Febbraio 2022 | Modalità Telematica
by Nexa Media Feb. 1, 2022

Feb. 1, 2022

Gentilissimi, vi segnaliamo che il 148° Mercoledì di Nexa, /*"Processing Alterity, Shaping the European Order"*/, con ospite *Annalisa Pelizza *(Università di Bologna e Università di Twente), si svolgerà*mercoledì 9 febbraio, dalle ore 18.00 alle ore 20.00*, in modalità telematica, utilizzando la piattaforma di videoconferenza BigBlueButton. Modera l'incontro: *Alvise Mattozzi* (Politecnico di Torino) Sarà possibile partecipare al seminario connettendosi al seguente indirizzo: https://didattica.polito.it/VClass/NexaEvent Nexa Center for Internet and Society Newsletter Se non visualizzi correttamente questo messaggio clicca qui <https://nexa.polito.it/mercoledi-148> NEXA 148° Mercoledì di Nexa Mercoledì 9 febbraio 2022, ore 18.00 - 20.00 Politecnico di Torino https://nexa.polito.it/mercoledi-148 Processing Alterity, Shaping the European Order Speaker Annalisa Pelizza (Università di Bologna e Università di Twente). Modera: Alvise Mattozzi (Politecnico di Torino) This event will be webcast live: https://nexa.polito.it/nexa-hangout-on-air L'INCONTRO SI SVOLGERÀ IN MODALITÀ TELEMATICA UTILIZZANDO IL SOFTWARE DI CONFERENCE CALL *BIGBLUEBUTTON*. Per partecipare all'incontro: https://didattica.polito.it/VClass/NexaEvent This lecture introduces the concept of *“alterity processing”* to account for the simultaneous enactment of individual “Others” and emergent European orders mediated by *data infrastructures for migration management*. Alterity processing refers to data infrastructures, knowledge practices and bureaucratic procedures through which populations unknown to European actors are translated into “European-legible” identities. Drawing upon a *Science and Technology Studies perspective*, the lecture provides empirical evidence and theoretical reflections on the co-production of migrant people and Europe as a polity through the digitization of registration and identification of third-country nationals. It shows how different registration and identification procedures compete to legitimize different chains of actors, data, and metadata as more authoritative than others. Competing procedures have governance implications, as well, with institutional boundaries shifting de facto, if not de jure. In this tension, it is not only the individual Other that is enacted but also specific bureaucratic orders cutting across old and new European actors and distinctive understandings of “Europe.” The lecture draws upon data collected in the context of the *“Processing Citizenship” project* (ERC StG No 714463, https://processingcitizenship.eu/) BIOGRAFIA - e informazioni supplementari [mercoledì148] *Annalisa PELIZZA* is Professor of Science and Technology Studies (STS) at the University of Bologna. Before that, she was Associate Professor at the Science, Technology and Policy Studies department of the University of Twente, where she is now Visiting Professor. Her research focuses on how governance by data infrastructures shapes modern institutions. By studying how data infrastructures entail broader but unnoticed transformations in the modern order of authority, which are buried in technical minutiae, Pelizza’s work brings tools proper of STS analyses to investigate macro political developments. Pelizza was the recipient of several excellence scientific grants and currently leads the “Processing Citizenship” research group (http://processingcitizenship.eu) funded by the European Research Council. The team investigates transnational data infrastructures for migration management as activities of European governance transformation. She is vice-president of STS Italia, elected member of the Board of the European Association for the Study of Science and Technology (EASST), member of the editorial board of Science, Technology and Human Values. *Letture consigliate e link utili:* * /Processing citizenship: digital registration of migrants as co-production of citizens, territory, and Europe?/ http://processingcitizenship.eu * Pelizza (2016), /Developing the Vectorial Glance: Infrastructural Inversion for the New Agenda on Government Information Systems/, disponibile qui <https://journals.sagepub.com/doi/full/10.1177/0162243915597478> * Pelizza (2020), /Processing Alterity, Enacting Europe: Migrant Registration and Identification as Co-construction of Individuals and Polities/, disponibile in OA qui <https://journals.sagepub.com/doi/full/10.1177/0162243919827927> * Pelizza (2021), /Towards a sociomaterial approach to inter-organizational boundaries: How information systems elicit relevant knowledge in government outsourcing/, disponibile in OA qui <https://journals.sagepub.com/doi/full/10.1177/0268396220934490> * Pelizza (2021), /Identification as translation: The art of choosing the right spokespersons at the securitized border/ disponibile in OA qui <https://journals.sagepub.com/doi/full/10.1177/0306312720983932> * Pelizza and Van Rossem (2021), /Sensing European Alterity. An analogy between sensors and Hotspots in transnational security networks/, disponibile qui <https://nexa.polito.it/nexacenterfiles/sensing-europe-altery.pdf> * Schot and Skipper (2018), /Experts and European transport integration, 1945–1958/ disponibile in OA qui <https://www.tandfonline.com/doi/full/10.1080/13501763.2011.544509> Che cosa sono il Centro Nexa e i cicli di incontri “Mercoledì di Nexa” e “Nexa Lunch Seminar” <https://www.facebook.com/nexa.center/> <https://twitter.com/nexacenter> <https://www.youtube.com/user/NexaCenter> #AnnalisaPelizza <https://twitter.com/Nisa00> #EuropeanResearchCouncil <https://twitter.com/erc_research> #ProcessCitizenship <https://twitter.com/ProcessCitizens> #nexawednesday <https://twitter.com/search?q=%23nexawednesday&src=typd> Il Centro Nexa su Internet & Società del Politecnico di Torino (Dipartimento di Automatica e Informatica) dal 2006 è un centro di ricerca indipendente e interdisciplinare che, in collaborazione con l'Università di Torino, studia Internet (e più in generale le Tecnologie digitali) e i suoi rapporti con la società. Maggiori informazioni all'indirizzo: http://nexa.polito.it/about. Durante i “*Mercoledì di Nexa*”, che si tengono *ogni 2° mercoledì del mese* alle *ore 18 in punto*, il Centro Nexa su Internet e Società apre le sue porte non solo agli esperti e a tutti coloro i quali lavorano con Internet, ma anche a semplici appassionati e cittadini. Il ciclo di incontri intende approfondire, con un linguaggio preciso ma accessibile, i temi legati alla Rete: motori di ricerca, Creative Commons, social networks, open source/software libero, neutralità della rete, libertà di espressione, privacy, file sharing, big e open data, smart cities e molto altro. Al centro di quasi tutti gli incontri un ospite pronto a dialogare con i direttori del Centro Nexa, il Prof. Juan Carlos De Martin del Politecnico di Torino e il Prof. Marco Ricolfi dell'Università di Torino, nonché lo staff e i Fellows del Centro Nexa. Maggiori informazioni sui Mercoledì di Nexa, incluso un elenco di tutti i “Mercoledì” passati, sono disponibili all'indirizzo: http://nexa.polito.it/mercoledi. Si segnala inoltre che dal maggio 2012 *ogni 4° mercoledì* del mese *dalle ore 13 alle ore 14* il Centro Nexa organizza anche i "*Nexa Lunch Seminar*". Una lista di tutti i “Lunch Seminar” passati è disponibile all'indirizzo: http://nexa.polito.it/lunch-seminars. See our events calendar <http://nexa.polito.it/events> if you're curious about future luncheons, discussions, lectures, and conferences not listed in this email. Our events are free and open to the public, unless otherwise noted. Responsabile Comunicazione Centro Nexa su Internet & Società: *Anita Botta*, tel: +39 011 090 7219, Mob: +39 347 131 3903, anita.botta(a)polito.it. Maggiori informazioni sui Mercoledì di Nexa e i Nexa Lunch Seminar, sono disponibili all'indirizzo: http://nexa.polito.it/events. Weekly Events Newsletter. Sign up <http://nexa.polito.it/mailing-lists> to receive this newsletter if this email was forwarded to you. To manage your subscription preferences, please click here <https://server-nexa.polito.it/cgi-bin/mailman/listinfo/nexa>. Connect & get involved: Jobs, internships, and more <http://nexa.polito.it/get-involved>. Cordiali saluti, -- Anita Botta Communication Manager Nexa Center for Internet & Society Politecnico di Torino – DAUIN Corso Duca degli Abruzzi, 24 - 10129 Torino web: https://nexa.polito.it/ mail: anita.botta(a)polito.it tel: 011 090 7219

1 0

Platform economy, what is happening around the EU and in particular in Easter Europe?
by Alessandro Brolpito Feb. 1, 2022

Feb. 1, 2022

Dear all, The ETF's study investigates changing patterns of work triggered by digitalisation in the six Eastern Partnership (EaP) countries: Armenia, Azerbaijan, Belarus, Georgia, Moldova and Ukraine. It aims in particular to fill the knowledge gaps on emerging platform work in the region, both web-based and on-location. The future of work – New forms of employment in the Eastern Partnership countries: Platform work | ETF (europa.eu) <https://www.etf.europa.eu/en/publications-and-resources/publications/future…> Workers from all the six countries access international Russian- and English-language web-based platforms. The most widespread web-based engagement relates mainly to higher-complexity specialist work in the information and communications technology (ICT) sector (software development and technology) and the creative and multimedia industry, in line with labour market demand. Alessandro

1 0

"US pushes to change EU’s digital gatekeeper rules"
by J.C. DE MARTIN Jan. 31, 2022

Jan. 31, 2022

*US pushes to change EU’s digital gatekeeper rules * /Washington officials worry that the Digital Markets Act could target American firms./ By Samuel Stolton January 31, 2022 1:16 pm The United States is pressing the EU to revise rules targeting digital giants to make them focus less on American companies and ensure they will also cover tech firms from outside the U.S., according to a new paper distributed to Brussels officials and seen by POLITICO. The move, which aims to change the so-called Digital Markets Act, highlights Washington's concern about plans to rein in the biggest tech companies as the U.S. government is targeting Brussels officials in the midst of ongoing talks in the Transatlantic Trade and Technology Council, a high-level transatlantic discussion group. In addition to the scope of the plans, the Biden administration also cites security concerns regarding Brussels' efforts. "We think it is important that regulatory efforts on either side of the Atlantic do not create unintended adverse consequences, such as inadvertent cybersecurity risks or harms to technological innovation," the paper states. "We have also been clear that we oppose efforts specifically designed to target only U.S. companies where similarly situated non-U.S. companies would not be covered." Late last week Washington circulated the eight-point policy document to "select" MEPs and member countries, in the middle of key negotiations between EU institutions on the bloc’s draft gatekeeper rules. [...] Continua qui: https://www.politico.eu/article/us-government-in-bid-to-change-eu-digital-m…

2 1

Progetto MonitoraPA: Google Analytics nella PA - CALL FOR PARTICIPATION
by Fabio Pietrosanti (naif) Jan. 31, 2022

Jan. 31, 2022

Sappiamo tutti che Google Analytics non và più bene per il GDPR (evviva!): Da qui l'idea di avviare un progetto per: 1. Misurare la presenza di Google Analytics sui siti delle PA 2. Notificare tutti i DPO delle PA 3. Fare Data Analytics dai risultati 4. Espostone al Garante dettagliato Ora servono "braccia" (intellettuali) per fare gli scripts, specificati qui https://github.com/hermescenter/monitorapa. La Chat del Gruppo di lavoro è https://t.me/monitoraPA . L’obiettivo software è spezzettare singoli script affinché: A) Ci sia come artefatto intermedio un file “amministrazione.txt” arricchito che sia importabile in excel con campi aggiunti e che permetta di fare analici di risultato per tipo di PA, per geografia, etc etc B) Lo script di evaluation se c’è Google Analytics sia sostituibile per riusare il progetto software, per misurare altre cose in futuro in modo agevole rifacendo emailing massivi e arricchimento tale e quale. Approposito di "B", vista la sentenza tedesca sull'uso dei Google Fonts Embedded, c'è spazio per estendere questo strumento come mezzo generico e di veloce adattabilità a fare test e notifiche massive, anche per altri scenari di violazione o non compliance. C'è già una disponibilità di più NGO e individui per disseminare i risultati del progetto, ma se non si crea un gruppo comunitario, il progetto non accadrà :* Fabio

2 1

Opportunita' dottorato LINAS in IA e diritto a QUB
by GC F Jan. 31, 2022

Jan. 31, 2022

Cari tutti, Volevo informarvi che ci sono posti disponibili per la scuola di dottorato LINAS finanziata da un grant Leverhulme qui a Queen's University Belfast, dove mi sono trasferito da poco come Chair in Law and Technology. Le tematiche sono quelle di IA, diritto e società'. In particolare, sono disponibili due posizioni a tema aperto (oltre ad altre con tematiche predefinite) nell'ambito di ricerca di LINAS. Di seguito trovate informazioni dettagliate: https://www.qub.ac.uk/Research/GRI/mitchell-institute/Study/linas Mettetemi pure in contatto con candidati interessati, se ne conoscete. Le scadenze indicate sul sito sono state protratte fino a fine Febbraio. Ci sono, dunque, ancora i tempi per inviare nuove domande di ammissione. Sono disponibile alla supervisione per la porzione giuridica del dottorato. La supervisione poi verrà' svolta anche da un altro docente con competenze tecniche. In generale, LINAS cerca giuristi con attitudine e disposizione a cimentarsi con aspetti tecnici o candidati STEM con interessi giuridici, etici e socio-economici (forse anche piu' adatti al tema di LINAS). In ogni caso, qualsiasi proposal che discute AI e proprietà' intellettuale, algorithmic enforcement online, content moderation, filtraggio e monitoraggio e tensioni con diritti fondamentali rientra tra i temi LINAS, oltre certamente a candidati interessati a studiare i profili di responsabilità della macchina e relativi aspetti tecnici, giuridici e etici. Con i saluti più' cordiali, Giancarlo

1 0

Annual report lays out the challenges of protecting fundamental rights in the digital age
by Alessandro Brolpito Jan. 31, 2022

Jan. 31, 2022

Dear all, The EU's annual report on Protecting fundamental rights in the digital age (europa.eu) <https://ec.europa.eu/commission/presscorner/detail/en/ip_21_6699> The report covers 5 policy areas: - Tackling the challenges of online moderation - Safeguarding fundamental rights where artificial intelligence is used - Addressing the digital divide - Protecting people working through platform - Supervising digital surveillance More about digital citizenship, to me the key success indicator of the current digital transition Europe’s Digital Decade: digital targets for 2030 | European Commission (europa.eu) <https://ec.europa.eu/info/strategy/priorities-2019-2024/europe-fit-digital-…> Alessandro

1 0

IBM Watson: an interesting lesson learned in AI/ML in medicine
by Enrico Nardelli Jan. 31, 2022

Jan. 31, 2022

It started in Jeopardy and ended in loss. IBM's flagship AI Watson Health has been sold to venture capitalists for an undisclosed sum thought to be around a billion dollars, or a quarter of what the division cost IBM in acquisitions alone since it was spun off in 2015. ... When clinical trials were published, Watson came up short every time. It didn't matter what field it was in, it consistently scored less well than human clinicians – sometimes under 50 per cent – and demonstrated some alarming blind spots in suggested treatments. Medical professionals had enough to worry about without babysitting a broken AI: it got dropped. ... IBM's Watson Health failed at the time, like so much AL/ML, because it didn't know what the question was – ironic, since the game of Jeopardy at which it excelled is all about deducing questions from data. It wanted to automate the highest skilled aspects of healthcare, diagnosis and treatment, but the problem wasn't one of getting the most data and the best algorithm. Rather, the problem was one of meaning. ... Fortunately, this sad case does not mean AI-based tools can't work in medicine, nor even that Watson Health won't do so, nor that AIs' evaluation and adoption has been slowed down. Ask the right questions, such as "why do some patients get readmitted" and can you spot them early?, and you get the right answers. AI in healthcare is being adopted, and it shows every sign of deserving its place. ... https://www.theregister.com/2022/01/31/machine_learning_the_hard_way/ -- EN ===================================================================== Prof. Enrico Nardelli Dipartimento di Matematica - Universita' di Roma "Tor Vergata" Via della Ricerca Scientifica snc - 00133 Roma tel: +39 06 7259.4204 fax: +39 06 7259.4699 mobile: +39 335 590.2331 e-mail: nardelli(a)mat.uniroma2.it home page: http://www.mat.uniroma2.it/~nardelli blog: http://www.ilfattoquotidiano.it/blog/enardelli/ http://link-and-think.blogspot.it/ ===================================================================== --

1 0

What is the quantum apocalypse and should we be scared?
by don Luca Peyron Jan. 30, 2022

Jan. 30, 2022

Profezie o tentativi di esorcizzare le paure? Buona lettura dl https://www.bbc.com/news/technology-60144498 _______________________ don Luca Peyron Direttore Ufficio per la Pastorale Universitaria Arcidiocesi di Torino www.universitari.to.it via XX settembre 83, Torino tel. 011 5156239

4 3

The Controversy Surrounding Hybrid Cryptography - Dhole Moments
by Alberto Cammozzo Jan. 30, 2022

Jan. 30, 2022

<https://soatok.blog/2022/01/27/the-controversy-surrounding-hybrid-cryptogra…> [...] Why Hybrid Cryptosystems? At some point in the future (years or decades from now), humanity may build a practical quantum computer. This will be a complete disaster for all of the cryptography deployed on the Internet today. In response to this distant existential threat, cryptographers have been hard at work designing and attacking algorithms that remain secure even when quantum computers arrive. These algorithms are classified as post-quantum cryptography (mostly to distinguish it from techniques that uses quantum computers to facilitate cryptography rather than attack it, which is “quantum cryptography” and not really worth our time talking about). Post-quantum cryptography is often abbreviated as “PQ Crypto” or “PQC”. However, a lot of the post-quantum cryptography designs are relatively new or comparatively less studied than their classical (pre-quantum) counterparts. Several of the Round 1 candidates to NIST’s post quantum cryptography project were broken immediately (PDF). Exploit code referenced in PDF duplicated below.: #!/usr/bin/env python3 import binascii, struct def recover_bit(ct, bit): assert bit < len(ct) // 4000 ts = [struct.unpack('BB', ct[i:i+2]) for i in range(4000*bit, 4000*(bit+1), 2)] xs, ys = [a for a, b in ts if b == 1], [a for a, b in ts if b == 2] return sum(xs) / len(xs) >= sum(ys) / len(ys) def decrypt(ct): res = sum(recover_bit(ct, b) << b for b in range(len(ct) // 4000)) return int.to_bytes(res, len(ct) // 4000 // 8, 'little') kat = 0 for l in open('KAT_GuessAgain/GuessAgainEncryptKAT_2000.rsp'): if l.startswith('msg = '): # only used for verifying the recovered plaintext. msg = binascii.unhexlify(l[len('msg = '):].strip()) elif l.startswith('c = '): ct = binascii.unhexlify(l[len('c = '):].strip()) print('{}attacking known-answer test #{}'.format('\n' * (kat > 0), kat)) print('correct plaintext: {}'.format(binascii.hexlify(msg).decode())) plain = decrypt(ct) print('recovered plaintext: {} ({})'.format(binascii.hexlify(plain).decode(), plain == msg)) kat += 1 More pertinent to our discussions: Rainbow, which was one of the Round 3 Finalists for post-quantum digital signature algorithms, was discovered in 2020 to be much easier to attack than previously thought. Specifically, for the third round parameters, the attack cost was reduced by a factor of 2^{20}, 2^{40}, and 2^{55}. That security reduction is just a tad bit more concerning than a Round 1 candidate being totally broken, since NIST had concluded by then that Rainbow was a good signature algorithm until that attack was discovered. Maybe there are similar attacks just waiting to be found? Given that new cryptography is accompanied by less confidence than incumbent cryptography, hybrid designs are an excellent way to mitigate the risk of attack advancements in post-quantum cryptography: If the security of your system requires breaking the cryptography used today AND breaking one of the new-fangled designs, you’ll always be at least as secure as the stronger algorithm. Art: Lynx vs Jackalope Why Is Hybrid Cryptography Controversial? Despite the risks of greenfield cryptographic algorithms, the NSA has begun recommending a strictly-PQ approach to cryptography and have explicitly stated that they will not require hybrid designs. Another pushback on hybrid cryptography comes from Uri Blumenthal of MIT’s Lincoln Labs on the IETF CFRG mailing list (the acronym CRQC expands to “Cryptographically-Relevant Quantum Computer”): Here are the possibilities and their relation to the usefulness of the Hybrid approach. 1. CRQC arrived, Classic hold against classic attacks, PQ algorithms hold – Hybrid is useless. 2. CRQC arrived, Classic hold against classic attacks, PQ algorithms fail – Hybrid is useless. 3. CRQC arrived, Classic broken against classic attacks, PQ algorithms hold – Hybrid is useless. 4. CRQC arrived, Classic hold against classic attacks, PQ algorithms broken – Hybrid useless. 5. CRQC doesn’t arrive, Classic hold against classic attacks, PQ algorithms hold – Hybrid is useless. 6. CRQC doesn’t arrive, Classic hold against classic attacks, PQ algorithms broken – Hybrid helps. 7. CRQC doesn’t arrive, Classic broken against classic attacks, PQ algorithms hold – Hybrid is useless. 8. CRQC doesn’t arrive, Classic broken against classic attacks, PQ algorithms broken – Hybrid is useless. Uri Blumenthal, IETF CFRG mailing list, December 2021 (link) Why Hybrid Is Actually A Damn Good Idea Art: Scruff Kerfluff Uri’s risk analysis is, of course, flawed. And I’m not the first to disagree with him. First, Uri’s framing sort of implies that each of the 8 possible outputs of these 3 boolean variables are relatively equally likely outcomes. It’s very tempting to look at this and think, “Wow, that’s a lot of work for something that only helps in 12.5% of possible outcomes!” Uri didn’t explicitly state this assumption, and he might not even believe that, but it is a cognitive trap that emerges in the structure of his argument, so watch your step. Second, for many candidate algorithms, we’re already in scenario 6 that Uri outlined! It’s not some hypothetical future, it’s the present state of affairs. To wit: The advances in cryptanalysis on Rainbow don’t totally break it in a practical sense, but they do reduce the security by a devastating margin (which will require significantly larger parameter sets and performance penalties to remedy). For many post-quantum algorithms, we’re still uncertain about which scenario is most relevant. But since PQ algorithms are being successfully attacked and a quantum computer still hasn’t arrived, and classical algorithms are still holding up fine, it’s very clear that “hybrid helps” is the world we most likely inhabit today, and likely will for many years (until the existence of quantum computers is finally settled). Finally, even in other scenarios (which are more relevant for other post-quantum algorithms), hybrid doesn’t significantly hurt security. It does carry a minor cost to bandwidth and performance, and it does mean having a larger codebase to review when compared with jettisoning the algorithms we use today, but I’d argue that the existing code is relatively low risk compared to new code. From what I’ve read, the NSA didn’t make as strong an argument as Uri; they said hybrid would not be required, but didn’t go so far as to attack it. Hybrid cryptography is a long-term bet that will protect the most users from cryptanalytic advancements, contrasted with strictly-PQ and no-PQ approaches. Why The Hybrid Controversy Remains Unsettled Even if we can all agree that hybrid is the way to go, there’s still significant disagreement on exactly how to do it. Hybrid KEMs There are two schools of thought on hybrid Key Encapsulation Mechanisms (KEMs): Wrap the post-quantum KEM in the encrypted channel created by the classical KEM. Use both the post-quantum KEM and classical KEM as inputs to a secure KDF, then use a single encrypted channel secured by both. The first option (layered) has the benefit of making migrations smoother. You can begin with classical cryptography (i.e. ECDHE for TLS ciphersuites), which is what most systems online support today. Then you can do your post-quantum cryptography inside the existing channel to create a post-quantum-secure channel. This also lends toward opportunistic upgrades (which might not be a good idea). The second option (composite) has the benefit of making the security of your protocol all-or-nothing: You cannot attack the weak now and the strong part later. The session keys you’ll derive require attacking both algorithms in order to get access to the plaintext. Additionally, you only need a single layer. The complexity lies entirely within the handshake, instead of every packet. Personally, I think composite is a better option for security than layered. Hybrid Signatures There are, additionally, two different schools of thought on hybrid digital signature algorithms. However, the difference is more subtle than with KEMs. Require separate classical signatures and post-quantum signatures. Specify a composite mode that combines the two together and treat it as a distinct algorithm. To better illustrate what this looks like, I outlined what a composite hybrid digital signature algorithm could look like on the CFRG mailing list: primary_seed := randombytes_buf(64) // store this ed25519_seed := hash_sha512256(PREFIX_CLASSICAL || primary_seed) pq_seed := hash_sha512256(PREFIX_POSTQUANTUM || primary_seed) ed25519_keypair := crypto_sign_seed_keypair(ed25519_seed) pq_keypair := pqcrypto_sign_seed_keypair(pq_seed) Your composite public key would be your Ed25519 public key, followed by your post-quantum public key. Since Ed25519 public keys are always 32 bytes, this is easy to implement securely. Every composite signature would be an Ed25519 signature concatenated with the post-quantum signature. Since Ed25519 signatures are always 64 bytes, this leads to a predictable signature size relative to the post-quantum signature. The main motivation for preferring a composite hybrid signature over a detached hybrid signature is to push the hybridization of cryptography lower in the stack so developers don’t have to think about these details. They just select HYBRIDSIG1 or HYBRIDSIG2 in their ciphersuite configuration, and cryptographers get to decide what that means. TL;DR Hybrid designs of post-quantum crypto are good, and I think composite hybrid designs make the most sense for both KEMs and signatures.

2 1