There is information that NSA is building quantum computer. Since it would make it possible to crack RSA using Shor's algorithm and we unlikely to know if they will successfully build it and start using, this becomes serious security problem. Would Tor team preventively implement post-quantum algorithms?


TLDR: No, it would be nice, but the primitives are not there yet, it is something that some of us think about though.

To secure Tor against quantum computer attacks you will need:

  • A replacement for TLS (to secure the inter-relay traffic).

    • Alternatively post quantum TLS ciphersuites can be used here instead, but none currently exist. (The old IETF draft that added NTRU suites does not count, because it needs major revision and does not provide a suitable signature algorithm, or perfect forward secrecy).
  • A signature algorithm (to replace RSA/Ed25519)

    • NTRUSign is completely, utterly, broken.
    • SPHINCS256 has rather large keys/signatures and is quite slow on systems without AVX2.
    • The other primitives here have bigger drawbacks than SPHINCS256.
  • A key exchange primitive (to replace Curve25519).

    • Simply using NTRUEncrypt will result in keys/ciphertexts that do not fit into single cells.
    • NTRU-KE is incredibly new, the on-the-wire components do not fit into a single Tor cell, and no one has done the work to determine "safe" parameter sets.
    • Supersingular Isogeney Diffie-Hellman is also incredibly new, and considerably more computationally expensive than Curve25519.
  • A symmetric encryption primitive (to replace CTR-AES128)

    • "Easy", pick something with a 256 bit security target.

All of this ignores the fact that NTRU is patent encumbered (to 2017 for the X9.98 parameter sets, 2020 for the newer parameter sets).


Tor explicitly state that : Tor does not protect you from global adversary. NSA is the prime example of global adversary. This is true even before implementation of quantum algorithm.

For your reference read the following quote from Tor.

Tor doesn't protect you from a global adversary

A global passive adversary would be a person or an entity able to monitor at the same time the traffic between all the computers in a network. By studying, for example, the timing and volume patterns of the different communications across the network, it would be statistically possible to identify Tor circuits and thus matching Tor users and destination servers.

It is part of Tor's initial trade-off not to address such a threat in order to create a low-latency communication service usable for web browsing, Internet chat or SSH connections.

As you hear from horse's mouth quantum algorithm or no quantum algorithm Tor does not protect you from NSA or similar Global adversaries which pretty soon will be any entity which in willing to spend enough fund to obtain the information independently. Genie is already out of the bottle!

  • 2
    The question is not "Does Tor protect against the NSA given that the NSA can monitor the entire network?" It was more like "Now that technology may be on the horizon that can solve large polynomials fast, has the Tor dev team considered ways to cope with that?" It is more about RSA becoming unsafe and less about the NSA.
    – Jobiwan
    Nov 22 '14 at 17:27
  • NSA attempts to be a GPA, but it most certainly is not one.
    – forest
    Feb 17 '19 at 12:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.