Re: [Cfrg] draft-atkins-suit-cose-walnutdsa on the Independent Stream

[Stephen Farrell <[e-mail]>]

Hiya,

On 20/01/2020 04:28, Martin Thomson wrote:
> If this were widely-deployed not-good crypto, that might change the
> situation, but the potential for harm in terms of misunderstanding
> the status of the mechanism seems significant enough to argue for not
> publishing even then.  In my view.  But, as ISE, that is Adrian's
> choice and Adrian's choice alone.

I agree that publishing this now would be detrimental. Once
the NIST PQ stuff reaches a conclusion (in a yearish maybe?)
then I'd expect we'll see a bunch of CFRG RFCs documenting
(some of) the set of algs that that process has produced as
"winners." I think it'd send a very confusing signal to
implementers if other RFCs describing crypto that aims to
be quantum resistant (or protocols using such) are emitted
ahead of those.

After those "winners" are known and sufficiently well
documented, then I'd not object to Derek's draft being
considered again, either by the ISE or CFRG, but having
pretty much any "post quantum" RFC published now seems
to me a bad plan, for any RFC stream.

Two other notes - if the ISE does decide to publish this
then I'd bet the ISE is likely to see more people doing
the same with other algorithms that are no longer in the
running in NISTland, which seems undesirable. (Were there
95 original entrants? I forget;-) Finally, if the ISE did
publish something like this, I'd really hope there'd be
content in the document that explains how this algorithm
got on in NISTland - I didn't see such text in the draft
(but only scanned it quickly) and am not even sure one
could craft good text now, while the NIST process is
still running.

So overall: "Dear ISE - please say no or put this one
on hold 'till the NIST thing is done."

Cheers,
S.