Re: [CFRG] Please review draft-ietf-drip-rid

["Blumenthal, Uri - 0553 - MITLL" <[e-mail]>]

On 9/17/21, 16:59, "Paul Hoffman" <[e-mail]> wrote:

 

>    On 17 Sep 2021, at 12:10, Blumenthal, Uri - 0553 - MITLL wrote:

> 

>    > Acceptable as *new* designs? I'm not a spokesman for the US 

>    > Government, but I doubt that.

> 

>    Then you seem to be doubting the NSA FAQ on quantum computing and 

>    cryptanalysis. 

>    https://media.defense.gov/2021/Aug/04/2002821837/-1/-1/1/Quantum_FAQs_20210804.PDF

 

Thanks for bringing this up - I wasn't aware of a fresh update (Aug 2021, wow!).

 

However, what I find there seems to support what I've been saying:

 

Q: What about new elliptic curves and associated algorithms?

A: Given the transition time required for most government programs to integrate new cryptography; the large established base of existing solutions; the desire to preserve interoperability with existing systems; and the expected standardization of post-quantum algorithms, NSA does not anticipate including additional algorithms or parameter selections in the CNSA Suite.

. . .

Q: When will CNSA be updated to quantum-resistant algorithms?

A: The intention is to update CNSA to remove quantum-vulnerable algorithms and replace them with a subset of the quantum-resistant algorithms selected by NIST at the end of the third round of the NIST post-quantum effort – NIST determines the timeline for each round. See the Future Cryptography section of this FAQ for more information.

 

 

 

>    > Once NIST PQC publishes its first PQ standards (Jan 2022), we'll see 

>    > if recommendations change then.

> 

>    This assumes that they are "standards", yet NIST has waffled mightily 

>    about what the next step will be, particularly about authentication 

>    mechanisms.

 

NIST promised to set the standards by Jan 2022. That set will include KEM (probably more than one), and Signature (authentication ;) - again, probably more than one. Whatever *subsequent* standards may come out of PQC, according to NIST, will *augment* rather than replace the 3rd-round selection. 

 

 

>    Maybe we can cut this thread here? If any of us are not a spokesperson 

>    for $ZZgovt, we should not immediately follow such statements with 

>    suppositions about what $ZZgovt will do. Let's let them do that and then 

>    we can respond.

 

OK, sure, I agree. (But couldn't refuse myself the pleasure of the last word in this sub-thread. 😉)