[CFRG] Re: Progressing NTRUPrime/Classic McEliece drafts

[Simon Hoerder <[e-mail]>]

Hi,

My private opinion as a mailing list lurker:
* I expect CFRG to standardize additional PQC algorithms if they’re sufficiently reviewed (based on rough consensus, as usual) and if there’s a clear benefit to have another standard or if it mirrors a paywalled standard.
* I currently struggle to see why the world needs another lattice KEM. If ISO/IEC standardizes NTRU and CFRG finds a way to mirror that outside of the ISO/IEC paywall that’ll be great. (I’m not having high hopes though.) But I don’t really see why ISO/IEC would standardize NTRU in the first place. Admittedly that may change in the future but having too many competing standards just leads to a bunch of crappy implementations.
* If NIST does not standardize Classic McEliece, I would expect CFRG to standardize that as an alternative. 
* Only because it has been mentioned as an option on this list before: If CFRG decides to run a competition for a new crypto algorithm, I would have a lot of questions about how that’s going to work. I don’t want to see this getting bogged down in process discussions but the processes to support such a competition (without interrupting all other CFRG work) need to be in the place. Also, I believe there’s things that can be learned from NISTs current PQC competition regarding the complexity of running such a thing for asymmetric algorithms. Most importantly: I’m not sure that there’s a need for a new competition. Sure I’d love to have cheaper & simpler PQC algorithms but I’m not convinced that a new competition now would produce trustworthy outcomes that are significantly cheaper / simpler.

Thanks for the good work all!
Simon