[CFRG] Re: Progressing NTRUPrime/Classic McEliece drafts

[Quynh Dang <[e-mail]>]

Hi Deirdre, Uri and all,

The reason for running a selection/competition process is explained in my
first message below.

Help those users to pick "the best" one to use! This is a core objective of
being cryptographers: to help the consumers of cryptography.

The CFRG did the curve competition process. No important and complex
process will ever be perfect. There will be people who will  criticize this
or that.

Don't let perfection be the enemy of the goods!

The CFRG curve process produced 2 fine curves and importantly it produced
solid trust in their security from all of the technical details
presented/discussed during the process.  And that was a very good result
the CFRG produced.

My guess is that the number of the people who analyzed and worked in the
field of cryptography at that time was a small fraction of the number of
the people today in the CFRG.  So, if the CFRG runs the
competition process, it will produce a lot of new cryptanalysis works and
performance data and it will be an excellent education course for the
consumers of cryptography.

The consensus process does not present obstacles for such a
selection process. The chairs will understand the technical details
presented during the process and make good consensus calls.  If something
the chairs want to be clarified, they will ask.

Regards,
Quynh.


On Wed, Jan 29, 2025 at 7:50 AM Quynh Dang <[e-mail]> wrote:

> Hi all,
>
>
>
> Below is my personal view which does not imply any view from NIST or
> anybody else.
>
>
>
> I think the CFRG needs to run a competition process to select a
> lattice-based KEM to provide a good option for the users who don’t want to
> use ML-KEM or NIST’s standardized cryptographic methods generally.
>
>
>
> At least there are 2 candidates we all know right now which are NTRU ( see
> here https://www.ntru.org/) and Streamlined NTRU Prime (see here
> https://ntruprime.cr.yp.to/) . There are important differences between
> them; they are not “about” the same. Something is true with NTRU does not
> mean it is automatically true with Streamlined NTRU Prime (security,
> performance or IPR etc.).
>
>
>
> Here are the reports of the second and third rounds of NIST's KEM
> selection process which had both candidates:
> https://nvlpubs.nist.gov/nistpubs/ir/2020/NIST.IR.8309.pdf  and
> https://nvlpubs.nist.gov/nistpubs/ir/2022/NIST.IR.8413-upd1.pdf .
>
>
>
> It would be very useful to have performance data of  (many) different
> implementations of the options of NTRU and Streamlined NTRU Prime on (many)
> different platforms including constrained ones beside the data we received
> during the first 3 rounds.
>
>
>
> Regards,
>
> Quynh.
>
> PS: I don’t plan to spend my time replying to potential messages asking me
> all sorts of things. My apologies in advance if I don't reply to your
> messages.
>
>>
>>