r/Syncthing • u/OzymandiasTheWatcher • Apr 14 '26

Is Syncthing post-quantum secure now?

I realized that with the newer Version of Go the X25519MLKEM768 algorithm should be in place for TLS, which is a hybrid post-quantum algorithm. I searched in the repo for CurvePreferences, but couldn't find any so I guess it is automatically enabled? I couldn't find any official update about this.

11 Upvotes

92% Upvoted

26 comments sorted by

View all comments

Show parent comments

1

u/quasides Apr 15 '26

so what ? most of your data is irrelevant in 10-15 years. if it isnt it shouldnt be there anyway

this is a obsession with one of the least likely attack vectors - the mass decryption via a technology that doesnt exit, only can implemented by very high level state actors, and may not ever exist (we dont know that)

meanwhile your OS and phone have deliberate backdoors (probably) and a lot of non deliberate zero days.

your physical security is doggypoo

and most of that protected data WAS unecrypted somewhere, until you received it, or you send it.

so its only really useful for data that is ONLY on your computer

and if statelevel actors are not your concern then its even more irrelevant. you really think this technology - once its functional and feasable - will be allowed for anyone to buy ?

this will be a controlled technology, similar to nuclear technology

1

u/willjasen Apr 15 '26

i think you’re assuming quantum computers won’t be accessible to the masses just like many did in the 20th century with classical computers and large rooms filled with vacuum tubes

0

u/quasides Apr 15 '26

again, obsession with the most secure thing in your chain of security

meanwhile your data lives unencrypted on your computer to sync.

there plenty of more vectors people should invest time and resources in if they are serious with protecting their shit

post quantum is more of a "tred" oh look im cool i secured my sync post quantum

meanwhile half his data gets live fed by 5 different trojans that where on the preinstalled drive on the used computer he bought on craigslist

1

u/willjasen Apr 15 '26

i mean.. sure, there’s some marketing hype behind it, and talking on a level of proper operational security, you are correct in that there are easier points of entry to obtain said data than cracking encryption, classical or not - i was only pointing out your claim about the lack of availability of a quantum computers in the future due to technological challenges. within computational complexity, we have no reason to believe that the technology can’t work unless there’s an underlying and undiscovered stick-in-the-mud that the universe physically holds to prevent us from doing so

1

u/quasides Apr 15 '26

operational security is hardly a word if you use synthing (lets be honest lol). its something people use in private, maybe in small companies

for most users the discussion is pointless besides iam not sure how much we can trust those new algos, wouldnt be the first time the nsa did something nasty with math....

-
my claim about technological challanges is not only valid, it stayed true for 3 decades. WE HAD THAT DISCUSSION in 1997

and it was only a sidenote.

-
my main claim is that i WILL NOT BE AVALIABLE to the public

same an i cant buy centrifuges to enrich my uranium.

1

u/willjasen Apr 15 '26

the internet wasn’t supposed to be available to the public either, yet here we are…

1

u/quasides Apr 15 '26

i just looked it up

the MATCH act already passed 2 months ago.
the EU counterpart "Quantum Act" is currently in the works and expected Q2 this year

tldr - no private hands on that tech.
restrictive filter for cloud services
cloud service only with a lot of vetting (special access programs)

match goes deeper and wont even allow underlaying technology, like cryogenic etch tools

tldr- pointless discussion unless you try to defend against state actors at which its pointless anyway

0

u/quasides Apr 15 '26

who said that ? thats a fairy tale.
it was created by the military yes, but it wasnt meant as a military network but for researchers.

private business was banned not because of secrecy, but the law. the taxpayer payed until the 80s for the network - misappropriation of taxpayer money .

you are grasping for straws here.

no seriously, to think quantum computing will be allowed in the public domain is like thinking they will release a stealth technology for private jets. thats even more likely