Re: [Cfrg] A terminology issue with "post-quantum cryptography"

[Dan Brown <[e-mail]>]

How about quantum-prudent or quantum-cautious cryptography?
/*
I'm not a PQC researcher, so please feel free to ignore my $0.02.

Finding (brief) terminology for this topic seems difficult, mainly because of the extra conjectures and timing (see below).  But it is only terminology, so it is probably okay just to stick to a tradition, or okay to churn it up, or be imperfect.

There is a need (see below) for distinct terminology for task and the tool.  For example, McEliece (the tool) is (reasonably) conjectured to provide quantum-resistance (the task).  Postquantum crypto could a help as a noun for a generic tool (conjectured to be quantum-resistant).

There seems some value in specificity.  For example, ECC is rarely called post-factoring or sieving-resistant ,etc. (to address the non-zero risk of a faster classical-computer factoring or sieving algorithm), partly because that's not specific to ECC.

There is a need for quantum-resistance because of a non-negligible risk of quantum computer. But it is bad if pushes towards this need seem to imply dropping ECC, because that would trade one risk for another.  Terms like postquantum and quantum-resistant do little to remind us that a quantum computer is only conjectural, so these terms must often be accompanied by further clarifications and explanations (e.g., don't drop ECC).

Supplementing ECC or RSA with some kind of conjecturally quantum-resistant proposal pre-emptively is often justified (the cost is worth addressing the risk), but calling this "postquantum" does not go far enough to encourage this practice (because post suggests waiting) or clarify the timing (recall how NIST called forward secrecy backtracking resistance.)

Shor's algorithm makes it a certainty that a large-enough quantum computer would break RSA and ECC. Confusing that certainty with various PQC proposals being quantum-resistant is inaccurate.  In this regard, the leading terms postquantum and quantum-resistant overstate the case (as do quantum-prudent and quantum-cautious).  To this end, I tried to think up a short name more specific to Shor's algorithm, but only came up with silly jokes, such as shor-ward-secure, or vague techno terms like no-hidden-group.  (This strategy also completely ignores the symmetric key case and Grover's algorithm, but that situation is simpler.)
*/