From: John Mattsson <john.mattsson@ericsson.com>
To: Thom Wiggers <thom@thomwiggers.nl>, "ipsec@ietf.org" <ipsec@ietf.org>
Thread-Topic: 
 =?Windows-1252?Q?[IPsec]_Symmetric_crypto_guidance_in_=12RFC_8784_is_misl?=
 =?Windows-1252?Q?eading?=
Thread-Index: AQHcoasba4n9oZVDR0SsfgNS+fVeCLWKLUAo
Date: Thu, 19 Feb 2026 16:05:37 +0000
Message-ID: 
 <AS5PR07MB10596901032AA82C0CBC7CF41896BA@AS5PR07MB10596.eurprd07.prod.outlook.com>
References: <3FBB4534-E3D0-4046-9622-5911EA38A2DA@thomwiggers.nl>
In-Reply-To: <3FBB4534-E3D0-4046-9622-5911EA38A2DA@thomwiggers.nl>
Accept-Language: en-US
Content-Language: en-GB
x-ms-exchange-antispam-messagedata-chunkcount: 1
x-ms-exchange-antispam-messagedata-0: 
 =?Windows-1252?Q?k/b/aYVMkfbe5q6bT3kXjfWD+rjrIzIxN2yJak2/2JgGfJeU67p0iXZT?=
 =?Windows-1252?Q?faOJoBCwa8t5m/0wTFBVwKlKP2vvxhW2Fx1IcZLlN3AC+shd3fBZqSsX?=
 =?Windows-1252?Q?bkhoRJ/tpPVMcWyTCjzIaaQEw3anxurNd3XESCyEL2tg7N/sLZonyjbF?=
 =?Windows-1252?Q?rgK/Rwnb6HGxF+pFZ9c4QJhH/FAbcVdkGTvGmmotDitXJdW+ryCpUYBQ?=
 =?Windows-1252?Q?5959FvyZxbyc9qmKNYCvZfHS4zQeh8sFzx2vPstgLIG89Ohb9lJtLHAJ?=
 =?Windows-1252?Q?D04xGE1u0N87y6/9hGoDN/ZcBlKc2YQxXy152vmmhX7cg+/whs86OaSw?=
 =?Windows-1252?Q?26N7VjQ4Amz9fT2/xhgllhspmyB/hOIcrJN4bV8JwBrdcNROQkTxDSGJ?=
 =?Windows-1252?Q?tKhejZQtS2nCMe0EWOMT/80LSjghS1gpcTpIGMayulYo/6PE3QUu/FkW?=
 =?Windows-1252?Q?v7Cm+i7A6wu0M0+2FlH4rk8dPSE0iKhfClCeLTSaXUw52gyKTbWckUQw?=
 =?Windows-1252?Q?FJVy7Ivy/i+aKNEaiWSB1yDemd14Tg/aRHi9y/iT7/peh+TArdUv6XRw?=
 =?Windows-1252?Q?j6akVHeDyZiuSt8ZwdY6f6O8l8GswQA4F346px7nruz6lUm0MRKYdJwS?=
 =?Windows-1252?Q?EFLhFIiKB9gs4As0kHnY66BOyqIh6+NvmSH0gIOWCWMSSFQ38bjc7ecp?=
 =?Windows-1252?Q?kaUD7meW6r2FQ2ti8GrDyjjPZNJbx0hMHh7UDTLHoFhcUzSHb9YZkXwS?=
 =?Windows-1252?Q?xAjMbJWe5CSlkGNTYzRxhv4P512W7mm773RaNyHENWLucqr52KVjF6tw?=
 =?Windows-1252?Q?IYKGRVemoj+NEbG/ViKb7bEgUfp2n01je/jgf1VIfF/R2wDVClL9irK7?=
 =?Windows-1252?Q?tJVug2J8QrSH4LlVevruCCDNjhidxtVbXXZ1HwyW3u50k3BqxRYEh9YU?=
 =?Windows-1252?Q?3eWGXI4k7fcXZe2g/O8BjGv2sdJ4vu03mCEkoIBEZRBBNfbed/eoDXf/?=
 =?Windows-1252?Q?WhN07QcGBUvdWot0ZgFQHH/4FbjNTMJAYib2e4sGwkNjkZvW9W7GIEdr?=
 =?Windows-1252?Q?fFE5atm2hTZ8z42oif/1Jt4J20mT4+rnGW9Q+F+rtkAuNn/wq4niaekC?=
 =?Windows-1252?Q?CAjuvaDdDnfKFEalBjX/EeynA6FIGluK+FC/zHlG7JdcGoCPkdbyFKd0?=
 =?Windows-1252?Q?AK1I/Y5UTDM10kZIbUmU9Ahc6aUfFGRH5ede6mixDVAo/XX8VdpxqIy1?=
 =?Windows-1252?Q?iePsew8sKDBH7qHF7Y1DK9EBsFPxatlnN6LF1ajah728LoobSO7K3ADM?=
 =?Windows-1252?Q?hMrIvzt5SUaZ2jcGEhJ04gxur5khon77njhqqBQC+ILofXgiiyrJQmbs?=
 =?Windows-1252?Q?G0zCRYufAvxAIaVvKy0PtmXc4dx2qT1sXER3YhXCzwEOoqYXpxMkoQx1?=
 =?Windows-1252?Q?i+aFzyzOypRgNvuWkZvgVb5uAx7WjNc+Cn5qkhNG+qLepJfrDQL5VuwZ?=
 =?Windows-1252?Q?Q/RGA+RYe8YTpLR02x8T3AFtOafgqe/cPwEnI1oQIG6Twe6IIOwIBDNo?=
 =?Windows-1252?Q?poVALnTlQUT+EEAOvvooBSEXFPuLVXLqXmmj/MvBQg8pn4F2ThJdFL/u?=
 =?Windows-1252?Q?zs44Tf9MFoaFnfmOo6g2PumrLVis8aeJ/Chjok7hPQDa/uWOnAakLdqr?=
 =?Windows-1252?Q?rzu4yFybk1o/u0mxZbYue8yVmb7TlIhZrCUue8pUmHZXj5vwc8W8UPxV?=
 =?Windows-1252?Q?LkLs6DizC6L/d4Vqwv7TN9AB9XnonSblmz2ozYlHf8t8BbZuAz8ydHUQ?=
 =?Windows-1252?Q?MrRsq6T4l9WgBi82NGHHF0x0Lw9t2dX6LwDjS5WmQMLkgWRGgk5q+JLF?=
 =?Windows-1252?Q?q0N8acT+90YDAukD6+qeT4PD2FtgDTgupVE=3D?=
Content-Type: multipart/alternative;
	boundary="_000_AS5PR07MB10596901032AA82C0CBC7CF41896BAAS5PR07MB10596eu_"
MIME-Version: 1.0
X-OriginatorOrg: ericsson.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-AuthSource: AS5PR07MB10596.eurprd07.prod.outlook.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 
 bd4139f6-b5cc-43db-0fc8-08de6fd0b8ae
X-MS-Exchange-CrossTenant-originalarrivaltime: 19 Feb 2026 16:05:37.4890
 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 92e84ceb-fbfd-47ab-be52-080c6b87953f
X-MS-Exchange-CrossTenant-mailboxtype: HOSTED
X-MS-Exchange-CrossTenant-userprincipalname: 
 F2wMJ4Iv3g/xXMkudt6GonPVjLfJCOgk1k+HIQNbeI91ZFJ/OrPjz+W9rlw+cFyrP3rkdldSF+bj+9t7oPpOKMM0bpbRzLaeLqnPLj7igiY=
X-MS-Exchange-Transport-CrossTenantHeadersStamped: DB9PR07MB9152
Message-ID-Hash: 4WFNTQBGBCEA3NWSHVMYM2ZDB2QMPUHA
X-Message-ID-Hash: 4WFNTQBGBCEA3NWSHVMYM2ZDB2QMPUHA
X-MailFrom: john.mattsson@ericsson.com
X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency;
 loop; banned-address; member-moderation; header-match-ipsec.ietf.org-0;
 nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size;
 news-moderation; no-subject; digests; suspicious-header
X-Mailman-Version: 3.3.9rc6
Precedence: list
Subject: =?utf-8?q?=5BIPsec=5D_Re=3A_Symmetric_crypto_guidance_in_=12RFC_8784_is_misl?=
	=?utf-8?q?eading?=
List-Id: Discussion of IPsec protocols <ipsec.ietf.org>
Archived-At: 
 <https://mailarchive.ietf.org/arch/msg/ipsec/KdgGMoH-neBjeRa3bymJ5Kg71gs>
List-Archive: <https://mailarchive.ietf.org/arch/browse/ipsec>
List-Help: <mailto:ipsec-request@ietf.org?subject=help>
List-Owner: <mailto:ipsec-owner@ietf.org>
List-Post: <mailto:ipsec@ietf.org>
List-Subscribe: <mailto:ipsec-join@ietf.org>
List-Unsubscribe: <mailto:ipsec-leave@ietf.org>

--_000_AS5PR07MB10596901032AA82C0CBC7CF41896BAAS5PR07MB10596eu_
Content-Type: text/plain; charset="Windows-1252"
Content-Transfer-Encoding: quoted-printable

Please do.

That this was nonsense was clear already in 2020. Both public-key and symme=
tric crypto should follow the five quantum-resistance security levels defin=
ed based on symmetric crypto. In addition of taking billions of years, the =
qubits required for a quantum attack on AES-192 would cover the surface are=
a of Betelgeuse...

John

From: Thom Wiggers <thom@thomwiggers.nl>
Date: Thursday, 19 February 2026 at 15:21
To: ipsec@ietf.org <ipsec@ietf.org>
Subject: [IPsec] Symmetric crypto guidance in =12RFC 8784 is misleading

Hi all,

I was going through the security considerations of RFC 8784 and I saw the f=
ollowing:

[=85]

In addition, the policy SHOULD be set to negotiate only quantum-secure symm=
etric algorithms; while this RFC doesn't claim to give advice as to what al=
gorithms are secure (as that may change based on future cryptographical res=
ults), below is a list of defined IKEv2 and IPsec algorithms that should no=
t be used, as they are known to provide less than 128 bits of post-quantum =
security:

  *   Any IKEv2 encryption algorithm, PRF, or integrity algorithm with a ke=
y size less than 256 bits.
  *   Any ESP transform with a key size less than 256 bits.
  *   PRF_AES128_XCBC and PRF_AES128_CBC: even though they can use as input=
 a key of arbitrary size, such input keys are converted into a 128-bit key =
for internal use.

[=85]

By our now more nuanced understanding of Grover=92s algorithm (in particula=
r how expensive and poorly parallelizable it is), this recommendation is en=
tirely no longer necessary. For example, NIST also write that using 128-bit=
 keys is just fine.

I=92m just not sure if this warrants submitting an erratum.  Should I submi=
t one?

Cheers,

Thom

--_000_AS5PR07MB10596901032AA82C0CBC7CF41896BAAS5PR07MB10596eu_
Content-Type: text/html; charset="Windows-1252"
Content-Transfer-Encoding: quoted-printable

<html>
<head>
<meta http-equiv=3D"Content-Type" content=3D"text/html; charset=3DWindows-1=
252">
</head>
<body>
<div style=3D"direction: ltr; font-family: Aptos, Arial, Helvetica, sans-se=
rif; font-size: 12pt; color: rgb(0, 0, 0);">
Please do.</div>
<div style=3D"direction: ltr; font-family: Aptos, Arial, Helvetica, sans-se=
rif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style=3D"direction: ltr; font-family: Aptos, Arial, Helvetica, sans-se=
rif; font-size: 12pt; color: rgb(0, 0, 0);">
That this was nonsense was clear already in 2020. Both public-key and symme=
tric crypto should follow the five quantum-resistance security levels defin=
ed based on symmetric crypto. In addition of taking billions of years, the =
qubits required for a quantum attack
 on AES-192 would cover the surface area of Betelgeuse...</div>
<div style=3D"direction: ltr; font-family: Aptos, Arial, Helvetica, sans-se=
rif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style=3D"direction: ltr; font-family: Aptos, Arial, Helvetica, sans-se=
rif; font-size: 12pt; color: rgb(0, 0, 0);">
John</div>
<div style=3D"direction: ltr; font-family: Aptos, Arial, Helvetica, sans-se=
rif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div id=3D"mail-editor-reference-message-container">
<div class=3D"ms-outlook-mobile-reference-message skipProofing" style=3D"di=
rection: ltr;">
</div>
<div class=3D"ms-outlook-mobile-reference-message skipProofing" style=3D"te=
xt-align: left; padding: 3pt 0in 0in; border-width: 1pt medium medium; bord=
er-style: solid none none; border-color: rgb(181, 196, 223) currentcolor cu=
rrentcolor; font-family: Aptos; font-size: 12pt; color: black;">
<b>From: </b>Thom Wiggers &lt;thom@thomwiggers.nl&gt;<br>
<b>Date: </b>Thursday, 19 February 2026 at 15:21<br>
<b>To: </b>ipsec@ietf.org &lt;ipsec@ietf.org&gt;<br>
<b>Subject: </b>[IPsec] Symmetric crypto guidance in &#18;RFC 8784 is misle=
ading<br>
<br>
</div>
<div class=3D"ms-outlook-mobile-reference-message skipProofing">Hi all,</di=
v>
<div class=3D"ms-outlook-mobile-reference-message skipProofing" style=3D"di=
rection: ltr;">
<br>
</div>
<div class=3D"ms-outlook-mobile-reference-message skipProofing">I was going=
 through the security considerations of RFC 8784 and I saw the following:</=
div>
<div class=3D"ms-outlook-mobile-reference-message skipProofing" style=3D"di=
rection: ltr;">
<br>
</div>
<div class=3D"ms-outlook-mobile-reference-message skipProofing">[=85]</div>
<p class=3D"ms-outlook-mobile-reference-message skipProofing" id=3D"section=
-6-5" style=3D"margin-top: 0px; margin-right: 0px; margin-left: 0px; font-f=
amily: &quot;Noto Sans&quot;, Arial, Helvetica, sans-serif; color: rgb(34, =
34, 34);">
In addition, the policy <b>SHOULD</b>&nbsp;be set to negotiate only quantum=
-secure symmetric algorithms; while this RFC doesn't claim to give advice a=
s to what algorithms are secure (as that may change based on future cryptog=
raphical results), below is a list of
 defined IKEv2 and IPsec algorithms that should not be used, as they are kn=
own to provide less than 128 bits of post-quantum security:</p>
<ul style=3D"margin: 0px 0px 1em 2em; padding-left: 0px;">
<li style=3D"font-family: &quot;Noto Sans&quot;, Arial, Helvetica, sans-ser=
if; color: rgb(34, 34, 34); margin: 0px 0px 0.25em;">
Any IKEv2 encryption algorithm, PRF, or integrity algorithm with a key size=
 less than 256 bits.</li><li style=3D"font-family: &quot;Noto Sans&quot;, A=
rial, Helvetica, sans-serif; color: rgb(34, 34, 34); margin: 0px 0px 0.25em=
;">
Any ESP transform with a key size less than 256 bits.</li><li style=3D"font=
-family: &quot;Noto Sans&quot;, Arial, Helvetica, sans-serif; color: rgb(34=
, 34, 34); margin: 0px 0px 0.25em;">
PRF_AES128_XCBC and PRF_AES128_CBC: even though they can use as input a key=
 of arbitrary size, such input keys are converted into a 128-bit key for in=
ternal use.</li></ul>
<div class=3D"ms-outlook-mobile-reference-message skipProofing">[=85]</div>
<div class=3D"ms-outlook-mobile-reference-message skipProofing" style=3D"di=
rection: ltr;">
<br>
</div>
<div class=3D"ms-outlook-mobile-reference-message skipProofing">By our now =
more nuanced understanding of Grover=92s algorithm (in particular how expen=
sive and poorly parallelizable it is), this recommendation is entirely no l=
onger necessary. For example, NIST also
 write that using 128-bit keys is just fine.&nbsp;</div>
<div class=3D"ms-outlook-mobile-reference-message skipProofing" style=3D"di=
rection: ltr;">
<br>
</div>
<div class=3D"ms-outlook-mobile-reference-message skipProofing">I=92m just =
not sure if this warrants submitting an erratum. &nbsp;Should I submit one?=
</div>
<div class=3D"ms-outlook-mobile-reference-message skipProofing" style=3D"di=
rection: ltr;">
<br>
</div>
<div class=3D"ms-outlook-mobile-reference-message skipProofing">Cheers,</di=
v>
<div class=3D"ms-outlook-mobile-reference-message skipProofing" style=3D"di=
rection: ltr;">
<br>
</div>
<div class=3D"ms-outlook-mobile-reference-message skipProofing">Thom</div>
</div>
</body>
</html>

--_000_AS5PR07MB10596901032AA82C0CBC7CF41896BAAS5PR07MB10596eu_--