AI
Hash function security properties and why 256-bit output is the minimum
A hash function maps arbitrary-length input to a fixed-size output and must be collision-resistant. Two different inputs must not produce the same hash. The birthday paradox sets the floor: with only 24 people in a room, there is a 50% chance two share a birthday. That same probability math applies to hash outputs, which is why 128-bit output is not enough. MD5 launched in 1991 with 128-bit output and fell in 2004 when researchers found a practical collision. SHA-1 followed with 160 bits, broke theoretically in 2013, and broke in a real attack in 2017. SHA-256 holds. Iavich’s rule: minimum 256-bit output, double it to 512 once quantum computers arrive.
How quantum computers break all asymmetric cryptography and the harvest-now decrypt-later threat
RSA, Diffie-Hellman, and elliptic curves all depend on problems that are hard to invert classically: factoring large primes, computing discrete logarithms. A quantum computer running Shor’s algorithm eliminates that asymmetry.
“quantum computer can easily break every asymmetric crypto system” — Maksim Iavich
That means HTTPS and every protocol built on public-key exchange breaks. The threat is already active. Encrypted traffic captured today sits on adversary storage, waiting. Once a capable machine arrives, the ciphertext decrypts retroactively. Iavich called it plainly:
“gather today break tomorrow” — Maksim Iavich
Four post-quantum cryptography families and NIST’s standardized schemes
Scientists have settled on four post-quantum families. Hash-based schemes build security on collision-resistant hash functions. Code-based schemes, led by McEliece, predate most of this field but still carry unresolved vulnerabilities. Lattice-based cryptography, grounded in worst-case hardness assumptions, is now dominant in practice. Multivariate polynomial cryptography exists but is rarely used.
NIST standardized four schemes: CRYSTALS-Kyber for encryption, and CRYSTALS-Dilithium, Falcon, and SPHINCS+ for digital signatures. The first three are lattice-based. SPHINCS+ is hash-based. In practice, hash-based and lattice-based approaches are what get deployed, and Verkle-HORST draws from both.
Lamport, Winternitz, HORST, and Merkle tree: building blocks of hash-based signatures
Lamport generates 2^n private key pairs, hashes each into a verification key, then leaks half per signing event. Winternitz shrinks that with a hash chain: each key is hashed W times to become its public key, so signing a chunk worth 11 means hashing it 11 times. HORST drops the chain, splits the digest into log₂T chunks, and indexes directly into a key table, one use per key. A Merkle tree makes it many-time: leaf nodes are one-time public keys, pairs hash upward to a root, and the signature includes the one-time sig plus sibling nodes to recompute that root.
Verkle-based HORST: replacing Merkle trees with vector commitments to cut signature size by 75%
Merkle trees produce proof sizes that grow logarithmically with tree size. Verkle trees, using vector commitments, produce O(1) proofs. Iavich’s team swapped the Merkle tree in HORST for a lattice-based Verkle tree and kept the HORST one-time signature layer intact. The sign and verify walkthrough (42:29) and the efficiency comparison against Merkle-HORST and SPHINCS+ (43:32) show the outcome:
“we decrease the signature size by 75%” — Maksim Iavich
The tradeoff is a hybrid security assumption. Both components must hold.
“If hashbased will be broken, our scheme will be broken. If latest based will be broken, our scheme will be broken.” — Maksim Iavich
Q&A
How much electricity does a quantum computer consume, and is it feasible for a household? Not feasible for home use yet because quantum computers require very low temperatures, making them prohibitively expensive. ▶ 45:24
What is your view on Microsoft’s Majorana topological qubit approach, and when will quantum computing require mandatory post-quantum migration? Microsoft’s topological qubit approach is interesting but less powerful than the top systems; on timing, Iavich pointed to NIST’s own 10-year hybrid-mode deadline as the clearest signal that quantum computers will arrive within a decade. ▶ 45:56
Notable Quotes
gather today break tomorrow Maksim Iavich · ▶ 20:54
quantum computer can easily break every asymmetric crypto system Maksim Iavich · ▶ 19:34
we decrease the signature size by 75% Maksim Iavich · ▶ 42:44
If hashbased will be broken, our scheme will be broken. If latest based will be broken, our scheme will be broken. Maksim Iavich · ▶ 44:37
Key Takeaways
- Deploy SPHINCS+ or a hash-based signature scheme now; they are NIST-standardized and quantum-resistant without depending on lattice security.
- Start migrating encrypted traffic to post-quantum standards immediately; adversaries are harvesting ciphertext today to decrypt once quantum computers arrive.
- Replacing a Merkle tree with a lattice-based Verkle tree in HORST achieves O(1) proof size and cuts signature size by 75% at the cost of a hybrid security assumption.
About the Speaker
Maksim Iavich
Maksim is professor and the Head of computer science at Caucasus University. Prof. Iavich is a Director of the Cyber Security Center, CST (CU). He is CEO & President of Scientific Cyber Security Association (SCSA). In 2025 Maksim is working as post-quantum cryptographer at Michigan University. Maksim is a cyber computer science and cyber security consultant in Georgian and international organizations. He used to be the invited speaker at international computer science conferences and is the organizer of many cyber security events. He was the key speaker at Defcamp and DeepSec, Hek.si, ManuSec, QITW2025 and many others in 2018-2025 with the talks about cyber security and artificial intelligence. He has many awards in cyber security field. Maksim is the author of many scientific papers covering cyber security, cryptography, artificial intelligence, machine learning, mathematical models, 5G security and simulations.