[CFRG] Re: Taking X-Wing to Independent Stream

[Tim Hollebeek <[e-mail]>]

I agree with this point of view.

 

-Tim

 

From: Sophie Schmieg <sschmieg=[e-mail]> 
Sent: Monday, March 3, 2025 4:44 PM
To: Loganaden Velvindron <[e-mail]>
Cc: John Mattsson <john.mattsson=[e-mail]>; CFRG <[e-mail]>; Independent Submissions Editor (Eliot Lear) <[e-mail]>
Subject: [CFRG] Re: Taking X-Wing to Independent Stream

 

In my opinion, there is indeed some urgency to the adoption of X-Wing. As mentioned, NIST is referring to it already, and several implementors are itching to deploy it, but do not want to deploy non-standard cryptography. This has led to the rather unfortunate situation that pure deployment of PQC is currently far easier than hybrid deployment, despite the hybrid deployment being recommended by some regulators (mostly BSI and ANSSI).

 

X-Wing has been well analyzed in academia [1], I don't think there are any concerns about the cryptographic correctness that would warrant further reviews here.

The only counterargument I know of is that there are similar, but not quite equivalent proposals that are more generic, but X-Wing, with its already well-defined format, is in my opinion a much more mature candidate, that given the time pressure to finally have a hybrid standard out would be highly welcomed.

 

[1] https://eprint.iacr.org/2024/039

 

On Fri, Feb 28, 2025 at 11:20 PM Loganaden Velvindron <[e-mail] <mailto:[e-mail]> > wrote:

Last time I checked, NIST is already referring to X-Wing.

"This is sometimes referred to as hybrid 978 PQ/T (post-quantum /
traditional) key establishment. For example, X-Wing is a hybrid 979
PQ/T KEM built from two components: ML-KEM (a lattice-based
post-quantum KEM) and 980 X25519 (a traditional Diffie-Hellman-style
key exchange)"

>From : https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-227.ipd.pdf

On Fri, 28 Feb 2025 at 22:27, John Mattsson
<john.mattsson=[e-mail] <mailto:[e-mail]> > wrote:
>
> Hi Deidre and the X-Wing Team,
>
>
>
> I am happy to help with any effort to get X-Wing published as an RFC. X-Wing is already the de facto standard for practical use of ML-KEM in TLS, DTLS, and QUIC. I hope it will be MTI as soon as possible. I think it is essential to document X-Wing in an RFC. I think NIST should refer to X-Wing as a good example of a hybrid KEM in SP 800-227. Chosing a fast secure Montgomery curve and using SHA-3 as KDF are the optimal choices. I am against CFRG combining ML-KEM with anything else.
>
>
>
> The only problem with X-Wing is that it is not generic, but X-Wing should be everybody's first hand choice if they want do deploy ML-KEM.
>
>
>
> Cheers,
>
> John
>
>
>
> From: Rohan Mahy <[e-mail] <mailto:[e-mail]> >
> Date: Friday, 28 February 2025 at 18:23
> To: Deirdre Connolly <[e-mail] <mailto:[e-mail]> >
> Cc: CFRG <[e-mail] <mailto:[e-mail]> >, Independent Submissions Editor (Eliot Lear) <[e-mail] <mailto:[e-mail]> >
> Subject: [CFRG] Re: Taking X-Wing to Independent Stream
>
> I'm willing to do document review.
>
> Thanks,
>
> -rohan
>
>
>
> On Fri, Feb 28, 2025, 08:33 Deirdre Connolly <[e-mail] <mailto:[e-mail]> > wrote:
>
> FYI the chairs have declined again to have an adoption call for X-Wing. The authors are now in discussion with the Independent Stream Editor to pursue review and publication there.
>
>
>
> https://datatracker.ietf.org/doc/draft-connolly-cfrg-xwing-kem/
>
>
>
> If you wish to volunteer document and cryptographic reviews for X-Wing we can take those to the ISE.
>
>
>
> Thanks for all the interest and support!
>
>
>
> Cheers,
>
> Deirdre, on behalf of the X-Wing Team
>
> _______________________________________________
> CFRG mailing list -- [e-mail] <mailto:[e-mail]> 
> To unsubscribe send an email to [e-mail] <mailto:[e-mail]> 
>
> _______________________________________________
> CFRG mailing list -- [e-mail] <mailto:[e-mail]> 
> To unsubscribe send an email to [e-mail] <mailto:[e-mail]> 

_______________________________________________
CFRG mailing list -- [e-mail] <mailto:[e-mail]> 
To unsubscribe send an email to [e-mail] <mailto:[e-mail]> 




 

-- 


Sophie Schmieg | Information Security Engineer | ISE Crypto | [e-mail] <mailto:[e-mail]>