There'll probably be discovered a class of problems which is hard and Q hard, provably and we'll be set. Something basically new to cryptography, that was tried once in the past but failed until seen through a new light of more recent maths or research fashion.
But until then it seems to me like something based on the difficulty of attacking hash functions would be a good bet for Q resistant. Totally unsure how to make a PK scheme from that, but it has a few nice properties:
- hashes are often tuneable, you can add more state and increase the keyspace/security
- good hashes don't have any weaknesses that Q can exploit
But until then it seems to me like something based on the difficulty of attacking hash functions would be a good bet for Q resistant. Totally unsure how to make a PK scheme from that, but it has a few nice properties:
- hashes are often tuneable, you can add more state and increase the keyspace/security
- good hashes don't have any weaknesses that Q can exploit
- hashes are often pretty fast
- hashes are well studied
- hashes seem to be hard in C and hard in Q