Re: [Cfrg] Postquantum cryptography in IETF protocols

[Ilari Liusvaara <[e-mail]>]

On Wed, Mar 15, 2017 at 01:10:58PM +0000, Tams, Benjamin wrote:
> Hi Watson,
> 
> > Why should we preempt the current NIST postquantum standardization efforts?
> 
> https://tools.ietf.org/html/draft-whyte-qsh-tls13-03

Briefly read that document. Some quick comments:

- Looks quite confusing. Especially the parts about HelloRetryRequest.
  But looking closer, that message is not used except for handling
  missed algorithm guess, right? So that if client guesses right (and
  it can make multiple guesses at cost of computation and bandwidth)
  there might not be HRR, right?
- I don't think extending TLS extensions past 64kB is feasible.
  Especially in ClientHello It would require changes with nasty
  side-effects.
- The document looks to be made for older draft of TLS 1.3. The
  way key is combined is bit unclear. I presume the key mixing
  should be done in two steps (adding a new step into TLS 1.3
  key schedule, as the two existing mixing steps are already
  used for PSK and DH) because that's likely the easiest to
  implement.
- Adding new handshake messages should be avoided, but AFAICT,
  there are none added.


-Ilari