[CFRG] Re: RG Last Call on draft-irtf-cfrg-hybrid-kems-12 and draft-irtf-cfrg-concrete-hybrid-kems-04

[Richard Barnes <[e-mail]>]

This message is a reply to D. J. Bernstein, but not directly on account of
not wanting to run afoul of his copyright lawyering

1. "I don't know what call you're referring to"

The specific question of "should we have both C2PRI-reliant and
non-C2PRI-reliant combiners" was posed to the RG at IETF 123, and the
feedback was that having both was appropriate.  Session recording here: (

If you think there is specific new information that the RG should consider,
please present that information in some manner more concrete than "the CVEs
we've seen this year".  And please explain how that information bears on
the specific question of whether implementers will make bad choices about
which algorithms to combine, ignoring clear advice in the relevant
specification.


2. "IETF participants use their best engineering judgment to find the best
solution for the whole Internet"

This doesn't mean there's one uniform solution that works for the whole
Internet.  We have OSPF and IS-IS and a panoply of BGP options.  We have
TLS and SSH and IPsec.  Different protocols users make different choices
all the time.

(Also, this is the IRTF, not the IETF.)


3. "Then how do you explain, e.g., CVE-2023-6135?"

Then how do you explain, e.g., CVE-2017-0379?

No cryptographic algorithm can prevent all software bugs.

--Richard

On Wed, Jul 8, 2026 at 12:26 AM Nick Sullivan <[e-mail]>
wrote:

> Dear CFRG,
>
> This message starts a two-week RG Last Call on two related documents. The
> last
> call ends on Wednesday July 22, 2026:
>
>   Hybrid PQ/T Key Encapsulation Mechanisms (generic constructions)
>   draft-irtf-cfrg-hybrid-kems-12
>   https://www.ietf.org/archive/id/draft-irtf-cfrg-hybrid-kems-12.html
>
>   Concrete Hybrid PQ/T Key Encapsulation Mechanisms
>   draft-irtf-cfrg-concrete-hybrid-kems-04
>
> https://www.ietf.org/archive/id/draft-irtf-cfrg-concrete-hybrid-kems-04.html
>
> Both are intended as Informational RFCs. Please reply on-list with your
> position
> on each document: ready to publish as-is, ready with specific changes, or
> not
> ready, together with the technical reasons. This feedback will help the
> chairs
> judge whether the documents are ready for IRSG review and publication.
>
> The scope and approach of this work were settled when the group adopted it
> well
> over a year ago, and both drafts have developed on the list in the open
> since
> then. This last call is about whether the text is technically correct and
> complete, so please ground any objection in a specific problem with the
> documents. Detailed comments are best filed as issues on the repositories
> (https://github.com/cfrg/draft-irtf-cfrg-hybrid-kems,
> https://github.com/cfrg/draft-irtf-cfrg-concrete-hybrid-kems) positions
> belong
> here on the list.
>
> Both documents were reviewed by the CFRG Crypto Review Panel ahead of this
> last
> call. The reviews are on the CFRG and crypto-panel lists:
>
>   Thomas Pornin (NCC Group), 3 June 2026, reviewed the generic framework
> with a
>   focus on the constructions and reductions, and concluded that it
> describes a
>   secure construction, with editorial and technical comments now reflected
> in -12.
>
>   Virendra Kumar (Qualcomm), 8 June 2026, reviewed the generic framework
> for
>   clarity, with notational comments now reflected in -12.
>
>   Russ Housley (Vigil Security), 2 June 2026, reviewed both drafts and
> found the
>   constructions and instantiations as specified.
>
> The current revisions incorporate changes proposed by the panel's comments.
>
> Thank you,
> Nick, for the CFRG chairs
> _______________________________________________
> CFRG mailing list -- [e-mail]
> To unsubscribe send an email to [e-mail]
>