Re: [CFRG] NSA vs. hybrid

[Natanael <[e-mail]>]

Just saw somebody post this from French ANSSI:

https://www.ssi.gouv.fr/en/publication/anssi-views-on-the-post-quantum-cryptography-transition/

Quoting two parts;

> Acknowledging the immaturity of PQC is important: ANSSI will not endorse
any direct drop-in replacement of currently used algorithms in the
short/medium term. However, this immaturity should not serve as an argument
for postponing the first deployments.

And;

> Even though hybridation is a relatively simple construction, ANSSI
emphasizes that the role of hybridation in the cryptographic security is
crucial and will be mandatory for phases 1 and 2 presented in the sequel.
In addition, the implementation security of the hybridation technique
should be also taken in consideration.

> Given that most post-quantum algorithms involve message sizes much larger
than the current pre-quantum schemes, the extra performance cost of an
hybrid scheme remains low in comparison with the cost of the underlying
post-quantum scheme.
> ANSSI believes that this is a reasonable price to pay for guaranteeing an
additional pre-quantum security at least equivalent to the one provided by
current pre-quantum standardized algorithms.

TLDR they plan to require a hybrid approach until PQC alternatives are
sufficiently established (have enough cryptoanalysis to be trusted to be
sufficiently strong).