[Last-Call] Re: iotdir review of draft-ietf-pquip-pqc-hsm-constrained-09

[Eliot Lear <[e-mail]>]

Hi Paul,

I definitely did not consider the charter.  I reviewed this from the 
perspective of the engineer of a constrained device.  On the whole, that 
person is not a cryptographer, but someone who is looking for the 
correct parameters to IETF work and the libraries that implement it to 
address the constraints I mentioned that are applicable to a product and 
its operating conditions.

That said, I take your points, particularly around suite selection.  It 
does aim us away from the IANA approaches that various crypto groups 
have taken.  But in that case, it may be worth adding a few words about 
how those groups might organize algorithm recommendations against the 
constraints I discussed.

Regards,

Eliot

On 26.10.2026 23:34, Paul Hoffman wrote:
> Wearing my PQUIP chair hat, I am concerned that Eliot's list of topics to discuss goes outside the PQUIP charter.
>
>
> On Oct 26, 2026, at 14:30, Eliot Lear<[e-mail]> wrote:
>> Thank you authors and WG for your efforts.
>> Summary: On the right track
>> This document talks about many, but not all, facets of post-quantum encryption as it relates to IoT devices.  I find the document slightly too academic.  There are a few practical matters to discuss:
>>      • I get the feeling that it could be more concise if one briefly reminds readers of the various constraints that need to be considered: CPU, memory, storage, bandwidth, and latency; and then having done that, I would expect a summary that maps to those constraints.  IoT audiences could use more prescriptive recommendations.
> The WG charter says "The WG will document operational and design guidance which supports PQC transition" and "The output of this WG is expended to inform protocol work and guidance developed by other WGs in the IETF". The IESG gets to decide this, but the WG stayed away from "more prescriptive recommendations", I think correctly.
>
>>      • Many constrained devices notoriously use low power and low bandwidth communications.  That means that key size can have an outsized impact on communications, especially on mesh networks where messages hit multiple hops.  Some guidance on suite-selection in these environments would be useful.
> The WG is not chartered to recommend suites. This document does discuss ML-DSA, and that is because it was already adopted by other WGs and could be used as a starting point for thinking about the problems discussed in the rest of the document.
>
>>    Alternatively, there may be instances where quantum-safe SPAKEs maybe more appropriate.  This could be explored and characterized.
> This WG was definitely not chartered to review or promote algorithms and protocols that come from the CFRG.
>
>>      • PKI implications are not discussed, and they certainly are there, especially on verification/validation.
>> Now it is true that not every document has to cover every topic, but the title of this document is Adapting Constrained Devices for Post-Quantum Cryptography, and how many documents do we want engineers to have to read on that broad subject?
> The rhetorical answer to that rhetorical question is "as many as are needed". The PQUIP WG felt that the subject matter for this draft was appropriately scoped. As the PQUIP charter says, "At any point, from early discussion of topics through later documentation stages, the WG may identify a more appropriate WG for the matter, and with coordination, dispatch it there." LAMPS (and maybe PLANTS?) would be appropriate places for such a discussion.
>
> --Paul Hoffman
>
> _______________________________________________
> last-call mailing list [e-mail]
> To unsubscribe send an email [e-mail]