Re: [Cfrg] Postquantum cryptography in IETF protocols

["Tams, Benjamin" <[e-mail]>]

Hi Aaron,

> NewHope has been implemented in Tor and also in Chrome for testing purposes.
> As for StrongSwan: they implement quite a lot. There's also a NTRU IKE implementation
> available in StrongSwan (https://wiki.strongswan.org/projects/strongswan/wiki/NTRU). 
> Just because there's an implementation of something doesn't necessarily warrant work
> on an internet draft/standard.

The other way round does neither: Just because there are Internet Drafts specifying
PQ-safe key exchange algorithms, this does not mean they have to be implemented. Anyway,
existing implementations are indications for the need of PQ-safe key exchange algorithms. 
Therefore, in my view, it is reasonable to specify Internet Drafts for state-of-the-art
PQ-safe key exchange algorithms suitable for implementation.

> To me PQC is quite a new field and security boundaries are not as established as they're
> for say symmetric or public key cryptography (someone correct me if I've missed major
> news in that area).

I agree. But as I mentioned in an earlier post (https://www.ietf.org/mail-archive/web/cfrg/current/msg09070.html)
we will not lose anything on security if we couple candidates for PQ-safe key exchange
algorithms with classical key exchange algorithms. Not for recommending them as a final
specification but for temporarily using them in applications where PQ-safety is needed.

As I noted above, it depends on the application whether a hybrid key exchange algorithm
is used that has the chance of being PQ-secure at the cost of increased key size and
increased running complexity. But if for an application one is willing to have that trade-off,
specifications for candidates of PQ-safe key exchange algorithms would be very useful. Again,
not for recommending them as a final specification but for temporarily using them in
applications where PQ-safety is needed.

> BTW there was a recent paper with some "improved" attacks on  NewHope (it doesn't
> break the scheme, they just recommend more conservative parameter choices) - 
> https://eprint.iacr.org/2017/221

@CFRG: Is there anyone interested in specifying PQ-safe key exchange algorithms at the
state of the art suitable for implementation 
(e.g., implementations of protocols as https://tools.ietf.org/html/draft-whyte-qsh-tls13-03)?

Kind regards,
Benjamin