[CFRG] Re: Progressing NTRUPrime/Classic McEliece drafts

[John Mattsson <[e-mail]>]

Deirdre Connolly wrote:
>I would generally agree, but for FrodoKEM - if the ISO standard actually happens, that is a less accessible specification...

I would go further and say that a paywalled ISO standard is a completely unacceptable reference. Ericsson has in recent years removed all mentioning of paywalled ISO and ANSI cryptographic standards internally. In the future our plan is to not accept suppliers to claim conformance to paywalled crypto standards. We see paywalled crypto standards as substantial cybersecurity risk. I am very happy that both FIPS 186-5 and RFC8446bis has removed references to the paywalled ANSI X9.62.

Regarding FrodoKEM, if some countries want to use FrodoKEM I think IETF should register code points in protocols like IKEv2, TLS 1.3, SSH.

I think [1] is a perfectly acceptable reference suitable for implementation. It is a different situation when there is only academic papers available, academic papers are typically not suitable for interoperable and secure implementation. Also BSI and ANSSI are perfectly capable of publishing documents on their own like [2].

I don't really think CFRG should spend time duplication [1], but I am also not against it.

[1] https://frodokem.org/files/FrodoKEM_standard_proposal_20241205.pdf

[2] https://www.bsi.bund.de/SharedDocs/Downloads/EN/BSI/Crypto/Quantum_Positionspapier.pdf?__blob=publicationFile&v=4