[CFRG] FW: PQC Standardization Beyond NIST PQC Round 4

[John Mattsson <[e-mail]>]

Hi,

Forwarding a mail I just sent to the NIST Post-Quantum Cryptography Email List that points out the need discuss and plan the future of PQC standardization. I think a likely and desired outcome is that NIST and CFRG works on future mechanisms in a collaborative way.

Cheers,
John

From: John Mattsson <[e-mail]>
Date: Tuesday, 12 October 2021 at 12:04
To: pqc-forum <[e-mail]>
Subject: PQC Standardization Beyond NIST PQC Round 4
Hi,

We are now very close to the end of round 3. As US government plans to update the CNSA suite already at the end of round 3, we might very soon see use of PQC in a lot of operational systems.

https://www.nsa.gov/Cybersecurity/Post-Quantum-Cybersecurity-Resources/

NIST seems to have a sensible and concrete plan for Round 4 with a new call of proposals.

https://csrc.nist.gov/CSRC/media/Presentations/status-update-on-the-3rd-round/images-media/session-1-moody-nist-round-3-update.pdf
But round 4 will still be limited to KEMs and Signatures, which is a great start but clearly limiting. The most obvious thing missing is maybe NIKE. Static-Static DH has been used a lot for a long time. While Static-Static and Ephemeral-Static DH have for good reasons been replaced Ephemeral-Ephemeral DH in TLS, the use of Static-Static Key Exchange and Ephemeral-Static DH for implicit authentication has increased in other areas to lower the number of flights / message size / complexity, or to move away from the insecure use of symmetrical group keys. KEMs can do implicit authentication, but not very efficiently.

https://s3.amazonaws.com/files.douglas.stebila.ca/files/research/presentations/20210513-Alphabet.pdf

https://signal.org/docs/specifications/x3dh/
https://noiseexplorer.com/patterns/XX/
https://datatracker.ietf.org/doc/draft-ietf-lake-edhoc/

https://datatracker.ietf.org/doc/html/rfc8152
https://datatracker.ietf.org/doc/draft-ietf-core-oscore-groupcomm/
https://ieeexplore.ieee.org/document/8950068

There are of course also a lot of other use cases where public-key cryptography is used such as Privacy-Enhancing Cryptography, Identity-Based Encryption, Signature Aggregation, etc., that cannot directly be replaced by KEMs and simple signatures.

https://csrc.nist.gov/projects/pec
https://www.ietf.org/archive/id/draft-irtf-cfrg-bls-signature-04
https://csrc.nist.gov/CSRC/media/Presentations/crystals-dilithium-round-3-presentation/images-media/session-1-crystals-dilithium-lyubashevsky.pdf

The community should start to discuss what comes after round 4. Standardization and deployment takes a long time. It is possible that CRQCs will never exist, but in the worst case we only have 10-20 years.

Some of this work might be done in CFRG which lately has complemented NIST in a very nice way, with NIST adopting CFRG publications such as Curve25519, EdDSA, XMSS, and LMS.

https://datatracker.ietf.org/rg/cfrg/documents/

Cheers,
John Preuß Mattsson
Ericsson