Re: [IPsec] Proposed method to achieve quantum resistant IKEv2

["Valery Smyslov" <[e-mail]>]

Hi,

>     >>> The only reason that comes to my mind is that you don’t fully trust
>     >>> QSKE. Are there any other reasons?
> 
>     >>I think that is one of the main reasons. Especially as we do not know
>     >>which QSKE we are talking about.
> 
> Another reason for not removing KE is potentially due to FIPS requirement. According to NIST
> (http://csrc.nist.gov/groups/ST/post-quantum-crypto/faq.html#Q1), if we have a hybrid key exchange, i.e. KE
> + post-quantum KE, the KE part can still go through FIPS validation and can still be FIPS-certified (until FIPS
> covers post-quantum algorithms).

Well, that are valid reasons. However, what makes me uncomfortable is that this design looks like yet another
short-term (or medium-term) solution. We already have draft-fluhrer-qr-ikev2 that was declared as 
a temporary short-term approach to countermeasure immediate threat until cryptography science gives us 
new well-studied QC-proof primitives to replace classic public key cryptography. Now it turns out that we don't have 
primitives we are certain in (at least for key exchange), so we decide to combine several different primitives
(which we don't fully trust in) with classic DH. That's a valid approach for transition to PQ cryptography,
but it doesn't look like long-term standard solution.

What particularly makes me unhappy:
- the design looks like violation of the "gold rule" of cryptography - "don't combine several week primitives, it doesn't add 
   to security, instead use one strong primitive" (I understand that each rule has exceptions, so that's probably the case, but still)
- when (and if) workable QC appears, the classic DH exchange will provide zero security, but will still consume resources,
   that will just be wasted. And the proposed design doesn't allow to get rid of DH completely, so the resulting
   protocol will be inefficient. 

So we end up with yet another temporary solution. That's not good.

Regards,
Valery.