Re: [MLS] MLS Compatibility with PQC

Hi Alex,

Karthik and I have been working on a hybrid PKE primitive in CFRG, with the
idea that it could be re-used in MLS:

https://tools.ietf.org/html/draft-barnes-cfrg-hpke-00

In the CFRG discussion of that draft, several folks suggested that we adapt
it to accommodate a general KEM.  I have a draft-01 of that in the works
that does that.  So there is something of a plan here!

Another thing that some folks have observed is that the length fields for
public keys are two octets long.  Would the keys for the schemes you're
interested in overflow those fields?

Thanks,
--Richard

On Fri, Feb 22, 2019 at 3:16 PM Alexander Sherkin <
Alexander.Sherkin@darkmatter.ae> wrote:

> Hello,
>
> The current protocol draft specifically relies on Diffie-Hellman crypto
> primitive. This makes perfect sense when classic crypto is used, but may be
> a limitation when post-quantum crypto (PQC) is required.
>
> If we assume that powerful enough quantum computers will become a reality
> in the next 10-15 years, any data protected with classic crypto we exchange
> today will be decryptable by a third party in 10-15 years. Hence, using
> classic crypto for new systems may not be a good idea.
>
> At the same time, it seems that the protocol is well positioned to rely on
> KEM crypto primitive. Relying on KEM instead of DH allows for a wider range
> of options including PQC primitives such as New Hope and Crystals Kyber
> making the protocol PQC-ready at least from the confidentiality perspective.
>
> To make it more general, KEM primitive may be defined as (C, s) =
> KEM-Encapsulate(PublicKey) and s = KEM-Decapsulate(PrivateKey, C).
>
> Thoughts?
>
> Thank you.
> Alex.
>
>
>
> Alexander Sherkin | Software Architect
> Tel:  | Mob: +1 416 414 7117
> Alexander.Sherkin@darkmatter.ae
>
> The information transmitted, including attachments, is intended only for
> the person(s) or entity to which it is addressed and may contain
> confidential and/or privileged material. Any review, retransmission,
> dissemination or other use of, or taking of any action in reliance upon
> this information by persons or entities other than the intended recipient
> is prohibited. If you received this in error, please contact the sender and
> destroy any copies of this information.
>
>
>
>
>
>
>
>
> _______________________________________________
> MLS mailing list
> MLS@ietf.org
> https://www.ietf.org/mailman/listinfo/mls
>