Re: [Cfrg] Postquantum cryptography in IETF protocols

["Tams, Benjamin" <[e-mail]>]

Hi Watson,

> Why should we preempt the current NIST postquantum standardization efforts?

According to the timeline suggested in 

http://csrc.nist.gov/groups/ST/post-quantum-crypto/workshops.html

first NIST standardization drafts  for postquantum key exchange algorithms will appear in 2023 - 2025. For the use cases that need long-term confidentiality of approx. 15 years (as mentioned in John's post) we should not wait 6-8 years before we can even start with implementing PQ-safe key exchange algorithms for these purposes.

I appreciate the efforts of NIST because the specification outputs will have passed a 3-5 year analysis phase and can then be considered more robust as post-quantum key exchange algorithms that we have today; and, maybe any specification that we can establish now, will eventually turn out to be vulnerable. On the other hand, if we implement a hybrid key exchange algorithm suitable for implementation, as in

https://tools.ietf.org/html/draft-whyte-qsh-tls13-03

we will not lose security but gain the possibility of having PQ-safety already in the near future. Furthermore, the draft already refers to four PQ-safe algorithms but only to one specific - NTRU.  Why not specify the remaining by CFRG? Not for recommending them as a final specification but for temporary using them in applications where PQ-safety is required already now.

Kind regards,
Benjamin