That is correct for communication over the public Internet, which is dominated by standards like TLS and SSH.
Encryption is also used for other purposes, e.g. communication between private devices or data storage, for which other modes of operation have significant advantages.
CBC historically was the most popular, but modern applications mostly use GCM which is counter mode. Block mode is too easy to get wrong, and doing it right is ~2x more expensive and less paralellizable.
CBC in its standard form is not parallelizable at all. However, like for hashes, one could decompose the data in several parallel streams that are encrypted independently with CBC, for multiplying the speed.
CBC with a block cipher has been completely obsolete for decades, even if the huge inertia of cryptography software development has kept it in use in many places, even until today.
However, CBC has a descendant that is still useful. CBC is a derivative of CFB, from which it differs only in the place from which the output is extracted from the encryption automaton.
There is another derivative of CFB, where the block cipher function with a secret key is replaced by a wider bijective mixing function, where the output is extracted by truncation. Here the role of the secret key is played by the part of the state that is not extracted in the output and the encryption automaton obtained thus is equivalent with a CFB mode for a block cipher where the key would be changed after each block. The fact that no 2 blocks are encrypted with the same key eliminates all security problems of the traditional CBC/CFB.
Only the fact that encryption and decryption are not parallelizable is a disadvantage, but this is partially mitigated because integrity verification is a byproduct that is provided without additional expenses (by extending the string to be encrypted with a block of known content).
This mode of operation is what the team Guido Bertoni, Joan Daemen, Gilles Van Assche and Michaël Peeters has called "duplex encryption for sponge functions".
While that team has contributed many important things to the progress of cryptography, I hate that they have always coined a great number of new names for old things, and always without mentioning at all the correspondence between their new names and the old concepts that had been used for decades before them.
Their initial contributions from 2007 to 2012 were all about what is obtained when in all those of the classic modes of operation that were known by 1980 in which the inverse of the block cipher is not needed, one substitutes the block cipher with a truncated wide mixing function (in the Shannon sense), but for all of those they have invented new fancy names, like "sponge absorbing" (derived from CFB-MAC), "sponge squeezing" (derived from OFB), "donkeySponge" (derived from the Alred optimization of CBC-MAC) and the like.
We only need the ability to make make 1 qubit with indefinite reliable / fully error corrected state. Quantum interconnects would allow for these to be connected into arbitrarily large quantum computers.
It's more akin to "we only need to make reliable transistors to make classical computers." With the invention of the planar transistor, going from 1 transistor to 100 or 100k was not that big of a step, comparatively.
It's really really easy to eliminate noise in a digital system of transistors. For analog systems with subtle values, I would say we still can't arbitrarily scale that up with transistors. And quantum is like analog but far worse.
Transistors connect to other transistors, directly or in switched arrangements. Qubits can be connected to other qubits likewise. E.g. a single photon emitter next to a nuclear spin qubit that can send an entangled photon through a beam splitter in a photonic switch, routing that entangled pair through fiber optic cables to other qubits where a combination of electric fields, filters, and occupied energy levels cause gate operations to be applied during absorption & re-emission. Except for the long-lived, error-corrected qubit, everything I described there is off-the-shelf commercial technology.
My company is making them. You just need to have a sufficiently resilient surface code, which means a single device with millions of physical qubits (the standard brute-force approach) or use a qubit architecture that is intrinsically noise-free by comparison, and only needs 15-50 physical qubits (what my company is doing, and our competitors). The industry as a whole is probably only a few years away from achieving this, in some form.
A "perfect" or "indefinitely stable" qubit sounds impossible. But so would a DRAM cell to an electrical engineer in the 40's. A DRAM cell continuously refreshes to maintain state, and as a result a single bit in RAM can have a mean time to failure measured in geologic time. Likewise a quantum error correction algorithm with a sufficiently large factor, driven continuously, will maintain qubit state indefinitely.
Electrical engineers in the 1940s already had "infinitely stable" memory in the form of delay lines and Williams tubes. Quantum error correction is incomparably more difficult than using digital bits.
Why is it that every time I read about quantum computers, fusion, and high energy density batteries, the word "just" seems extremely load-bearing, but results are like just, nowhere to be seen
reply