Re: [Cfrg] New draft on the transition from classical to post-quantum cryptography

["Blumenthal, Uri - 0553 - MITLL" <[e-mail]>]

On 5/8/17, 9:46 AM, "Cfrg on behalf of Paul Hoffman" <[e-mail] on behalf of [e-mail]> wrote:

    On 8 May 2017, at 5:46, Salz, Rich wrote:
    
    >> And I completely want to avoid any discussion of such a specification 
    >> in this
    >> document; I consider "when you want to move to post-quantum"
    >> orthogonal to "at the time you move, here are your best options".
    >
    > Well, it's not of course.  What you do when you move depends on what 
    > is available at that time and options are likely to improve as Science 
    > Marches Forward.
    
    Fair point. There is a subtlety in "when you want to move to 
    post-quantum" of "there is a post-quantum solution at the time that 
    meets your needs". 

Technically you both are correct, and the two issues (“when” and “to what”) are orthogonal. In practice however they lose much without one another. 

I understand that we may have a better idea now as to “when” over what “the best options” are likely to be “then” (so it’s easier to talk about “when”, even though both recommendations – not just “to what” but also “when” - may change as time advances).

I see the two as two parts of a single document, or as two closely related drafts, cross-referenced, and released together.


    My unstated assumption is that NIST and others around 
    the world will have standardized on some solutions before the readers of 
    this document (or a future version of it) feel the need to change. I'll 
    reflect that better in the next draft.

Wouldn’t you agree that for long-term documents (those that need to survive for 15+ - 20+ years from now) the “need to change” is now with a pretty high probability? Wouldn’t that break your assumption?
    
    > I also think when to move depends on what you're trying to do.

Yes. ;-)

For some applications the need appears to be “now”.