Re: [Cfrg] Postquantum cryptography in IETF protocols

There's a new draft of that document on the way, which has been developed
in collaboration with some other stakeholders and should be more up-to-date
wrt TLS 1.3. Again, not to overpromise, but hopefully by the end of next
week.

Cheers,

William

On Wed, Mar 15, 2017 at 11:24 AM, Ilari Liusvaara <ilariliusvaara@welho.com>
wrote:

> On Wed, Mar 15, 2017 at 01:10:58PM +0000, Tams, Benjamin wrote:
> > Hi Watson,
> >
> > > Why should we preempt the current NIST postquantum standardization
> efforts?
> >
> > https://tools.ietf.org/html/draft-whyte-qsh-tls13-03
>
> Briefly read that document. Some quick comments:
>
> - Looks quite confusing. Especially the parts about HelloRetryRequest.
>   But looking closer, that message is not used except for handling
>   missed algorithm guess, right? So that if client guesses right (and
>   it can make multiple guesses at cost of computation and bandwidth)
>   there might not be HRR, right?
> - I don't think extending TLS extensions past 64kB is feasible.
>   Especially in ClientHello It would require changes with nasty
>   side-effects.
> - The document looks to be made for older draft of TLS 1.3. The
>   way key is combined is bit unclear. I presume the key mixing
>   should be done in two steps (adding a new step into TLS 1.3
>   key schedule, as the two existing mixing steps are already
>   used for PSK and DH) because that's likely the easiest to
>   implement.
> - Adding new handshake messages should be avoided, but AFAICT,
>   there are none added.
>
>
> -Ilari
>
> _______________________________________________
> Cfrg mailing list
> Cfrg@irtf.org
> https://www.irtf.org/mailman/listinfo/cfrg
>