Re: [Cfrg] Postquantum cryptography in IETF protocols

[Aaron Zauner <[e-mail]>]

Hi,

Quick comment:

> On 14 Mar 2017, at 18:31, Tams, Benjamin <[e-mail]> wrote:
> 
> Hi John,
> 
>> Good that CFRG starts some more detailed discussion on PQC. It makes sense
>> to support post-quantum key exchange for use cases that need long-term
>> confidentiality (15 years). For other use cases I think it can wait until
>> PQC key exchange algorithms has been thoroughly evaluated and
>> standardized. If implemented now, it should be used in addition to ECDHE,
>> just like Google has done with their experimental New Hope implementation.
> 
> I absolutely agree with your view on the subject. Especially for those use
> cases where the attack scenario "collect today, decrypt tomorrow" is a threat,
> we should start thinking of PQ-safe key exchange methods in time. Even if
> they eventually turn out to be insecure; we can now combine them with
> classical key exchange algorithms. We have nothing to lose.
> 
> There is already IETF work addressing PQ-security in Internet protocols, e.g.
> IKE and an Internet Draft for a Quantum-Safe Hybrid Ciphersuite for TLS
> 
> https://tools.ietf.org/html/draft-fluhrer-qr-ikev2-03
> https://tools.ietf.org/html/draft-whyte-qsh-tls13-03
> 
> On the other hand, there is (to my knowledge) no specification for a PQ-safe
> patent-free key exchange algorithm suitable for implementation. In fact, in
> https://tools.ietf.org/html/draft-whyte-qsh-tls13-03
> only NTRUEncrypt is specified but is subject to patents.
> 
> A possible first step is that CFRG creates an Internet Draft. In fact,
> the algorithm New Hope has already been implemented as a plugin for
> strongSwan (IPSec implementation for the Linux kernel)
> 
> https://github.com/strongswan/strongswan/tree/master/src/libstrongswan/plugins/newhope
> 
> So why do we not start with a draft for which the above implementation can
> serve as a reference implementation?

NewHope has been implemented in Tor and also in Chrome for testing purposes. As for StrongSwan: they implement quite a lot. There's also a NTRU IKE implementation available in StrongSwan (https://wiki.strongswan.org/projects/strongswan/wiki/NTRU). Just because there's an implementation of something doesn't necessarily warrant work on an internet draft/standard. To me PQC is quite a new field and security boundaries are not as established as they're for say symmetric or public key cryptography (someone correct me if I've missed major news in that area). BTW there was a recent paper with some "improved" attacks on NewHope (it doesn't break the scheme, they just recommend more conservative parameter choices) - https://eprint.iacr.org/2017/221


Aaron