Re: [Cfrg] I-D Action: draft-irtf-cfrg-xmss-hash-based-signatures-06.txt

["A. Huelsing" <[e-mail]>]

Hi,

>> The reason
>> being that the required solution differs. E.g., for lattice-based
>> key-exchange where we still got some doubts on the actual security
>> of specific parameter sets, the solution is to deploy it right now in
>> combination with a non-pq but classically secure scheme. 
> I agree that design seems to have merit. I'm not at the point
> where I think it is "the solution."
Yes, sorry. It should be "a possible solution". 
>> That way,
>> we at least get the same security as before... 
> But we break interop, we add new kinds of code with which not
> many are familiar, we make some values much bigger than those
> for which protocols were designed and maybe we change performance
> characteristics in unexpected ways. So it is not clear to me
> that the do-it-in-parallel design is one that we do want to
> recommend yet. (I do expect we'll get there but I don't want
> to see getting there delaying more and better deployment of
> current technologies.)

Sure, but isn't this something a working group should
always check before suggesting to use a new building block.
(I am referring to the working groups that are using e.g. crypto)
It is definitely our part to place a warning sign on building
blocks that behave significantly different than previous ones.