Re: [CFRG] Classic McEliece

[Peter C <[e-mail]>]

Almost the entire content of draft-josefsson-mceliece is taken verbatim from the first working draft of ISO/IEC 18033-2/AMD2.  There is a prominent copyright notice on the WD warning against reproducing any part of the document without prior written permission.  The scheme may be owned by the Classic McEliece submission team, but the text of the WD is not.

If the CRFG wants a specification to use as an alternative to an ISO standard, this is not the way to go about it.

Peter

From: CFRG <[e-mail]> On Behalf Of John Mattsson
Sent: Sunday, October 15, 2023 10:39 AM
To: Simon Josefsson <simon=[e-mail]>; [e-mail]
Subject: Re: [CFRG] Classic McEliece

Hi,

I agree that Classic McElice should be standardized somewhere. There seems to be significant interest in having a more conservative KEM than ML-KEM. Even if I personally think Curve25519+ML-KEM is conservative enough for most use cases.

ISO standards are paywalled which goes completely against the values of the Internet community.  I think ISO security standards are completely unusable. Secret and paywalled algorithms should not be seen as acceptable anymore. Paywalled algorithm standards means that much fewer security researchers has access to them. This is both a security and a trust problem. There are also many examples were implementations use publicly available material instead of paywalled standards which creates both interoperability and security problems. Now in 2023 there have been several court verdicts in the EU and US stating that all technical standards referenced by laws must be freely available. I think cryptographers should boycott ISO.

NIST said this week that they are planning to standardize 1-2 of the code-based KEMs of which Classic McElice is one. The other two candidates are BIKE and HQC. It therefore seems quite likely that NIST will standardize Classic McElice. I think CFRG should wait on NIST standardization. If NIST choses to standardize Classic McElice, I don't think a CFRG specification is needed.

If NIST choses to not standardize Classic McElice and a paywalled ISO standard is the only reference, I think a CFRG specification is the way to go.

Cheers,
John

From: CFRG <[e-mail]> on behalf of Simon Josefsson <simon=[e-mail]>
Date: Sunday, 15 October 2023 at 11:20
To: [e-mail] <[e-mail]>
Subject: [CFRG] Classic McEliece
Hi

Here is a starting point to describe Classic McEliece as an IETF draft,
based on the proposed Classic McEliece ISO draft:

https://datatracker.ietf.org/doc/html/draft-josefsson-mceliece

All non-editorial feedback should preferrably go upstream to the Classic
McEliece team, but you are welcome to give feedback in the issue
tracker: https://gitlab.com/jas/ietf-mceliece

/Simon