[Last-Call] Re: iotdir review of draft-ietf-pquip-pqc-hsm-constrained-09

["K Tirumaleswar Reddy (Nokia)" <[e-mail]>]

Hi Eliot,

Thanks for the review. Thanks, Paul, for clarifying the charter scope.

On bandwidth, we propose adding the following to Section 4:

“Larger public keys, ciphertexts, and signatures also increase the data transmitted, which affects devices on low-power, low-bandwidth links, particularly multi-hop mesh networks, where fragmentation and retransmission add latency and energy cost. Algorithm selection for such environments is left to the relevant protocol specifications.”

Such work is already under way. For instance, LAKE is migrating from EDHOC to PQC.

Best Regards,
-Tiru

From: Eliot Lear <[e-mail]>
Sent: Tuesday, October 27, 2026 5:03 AM
To: Paul Hoffman <[e-mail]>; The IESG <[e-mail]>
Cc: [e-mail]; [e-mail]; [e-mail]; [e-mail]
Subject: Re: [Last-Call] Re: iotdir review of draft-ietf-pquip-pqc-hsm-constrained-09


Hi Paul,

I definitely did not consider the charter.  I reviewed this from the perspective of the engineer of a constrained device.  On the whole, that person is not a cryptographer, but someone who is looking for the correct parameters to IETF work and the libraries that implement it to address the constraints I mentioned that are applicable to a product and its operating conditions.

That said, I take your points, particularly around suite selection.  It does aim us away from the IANA approaches that various crypto groups have taken.  But in that case, it may be worth adding a few words about how those groups might organize algorithm recommendations against the constraints I discussed.

Regards,

Eliot
On 26.10.2026 23:34, Paul Hoffman wrote:

Wearing my PQUIP chair hat, I am concerned that Eliot's list of topics to discuss goes outside the PQUIP charter.





On Oct 26, 2026, at 14:30, Eliot Lear <[e-mail]><mailto:[e-mail]> wrote:



Thank you authors and WG for your efforts.

Summary: On the right track

This document talks about many, but not all, facets of post-quantum encryption as it relates to IoT devices.  I find the document slightly too academic.  There are a few practical matters to discuss:

    • I get the feeling that it could be more concise if one briefly reminds readers of the various constraints that need to be considered: CPU, memory, storage, bandwidth, and latency; and then having done that, I would expect a summary that maps to those constraints.  IoT audiences could use more prescriptive recommendations.



The WG charter says "The WG will document operational and design guidance which supports PQC transition" and "The output of this WG is expended to inform protocol work and guidance developed by other WGs in the IETF". The IESG gets to decide this, but the WG stayed away from "more prescriptive recommendations", I think correctly.



    • Many constrained devices notoriously use low power and low bandwidth communications.  That means that key size can have an outsized impact on communications, especially on mesh networks where messages hit multiple hops.  Some guidance on suite-selection in these environments would be useful.



The WG is not chartered to recommend suites. This document does discuss ML-DSA, and that is because it was already adopted by other WGs and could be used as a starting point for thinking about the problems discussed in the rest of the document.



  Alternatively, there may be instances where quantum-safe SPAKEs maybe more appropriate.  This could be explored and characterized.



This WG was definitely not chartered to review or promote algorithms and protocols that come from the CFRG.



    • PKI implications are not discussed, and they certainly are there, especially on verification/validation.

Now it is true that not every document has to cover every topic, but the title of this document is Adapting Constrained Devices for Post-Quantum Cryptography, and how many documents do we want engineers to have to read on that broad subject?



The rhetorical answer to that rhetorical question is "as many as are needed". The PQUIP WG felt that the subject matter for this draft was appropriately scoped. As the PQUIP charter says, "At any point, from early discussion of topics through later documentation stages, the WG may identify a more appropriate WG for the matter, and with coordination, dispatch it there." LAMPS (and maybe PLANTS?) would be appropriate places for such a discussion.



--Paul Hoffman



_______________________________________________

last-call mailing list -- [e-mail]<mailto:[e-mail]>

To unsubscribe send an email to [e-mail]<mailto:[e-mail]>