Re: [openpgp] PQC encryption algorithm selection

[Simo Sorce <[e-mail]>]

Hi Aron,
Why so much redundancy in EC curves?

This is basically the same thing 3 times over, wouldn't it be more
appropriate to just allow a singe EC curve family so there is no risk
of interoperability issues between implementations ?

Simo.

On Wed, 2024-02-07 at 11:39 +0000, Aron Wussler wrote:
> Hi everyone,
> 
> In the next weeks, before IETF 119, we'd like to collect feedback about the algorithm selection implemented in the draft [1]. We're interested in presenting some vectors for the next meeting. It would be great if you could provide feedback by March 1st.
> 
> To keep the discussion focused we're going to start from the encryption algorithm selection, KEM combiners will follow (since it may also depend on the algorithm selection). Digital signatures will also follow in another thread.
> 
> Right now, we have the following list of algorithms (in table 1)
>     +====+===============================+=============+=============+
>     | ID | Algorithm                     | Requirement | Definition  |
>     +====+===============================+=============+=============+
>     | 29 | ML-KEM-768 + X25519           | MUST        | Section 5.2 |
>     +----+-------------------------------+-------------+-------------+
>     | 30 | ML-KEM-1024 + X448            | SHOULD      | Section 5.2 |
>     +----+-------------------------------+-------------+-------------+
>     | 31 | ML-KEM-768 + ECDH-NIST-P-256  | MAY         | Section 5.2 |
>     +----+-------------------------------+-------------+-------------+
>     | 32 | ML-KEM-1024 + ECDH-NIST-P-384 | MAY         | Section 5.2 |
>     +----+-------------------------------+-------------+-------------+
>     | 33 | ML-KEM-768 + ECDH-            | MAY         | Section 5.2 |
>     |    | brainpoolP256r1               |             |             |
>     +----+-------------------------------+-------------+-------------+
>     | 34 | ML-KEM-1024 + ECDH-           | MAY         | Section 5.2 |
>     |    | brainpoolP384r1               |             |             |
>     +----+-------------------------------+-------------+-------------+
> 
> Please provide feedback on the algorithms, and if you think they should be "MUST", "SHOULD", or "MAY". The proposed list is derived from the results of the NIST standardization process, hybrid with the curves already supported from OpenPGP for compliance purposes.
> 
> Finally, please note that this is not the sole opportunity to standardize PQC algorithms: as of the crypto-refresh, new algorithms will need a specification and designated expert review, and not an RFC.
> 
> Cheers and thanks,
> Aron
> 
> 
> [1] https://www.ietf.org/archive/id/draft-ietf-openpgp-pqc-00.html#name-algorithm-specifications
> 
> --
> Aron Wussler
> Sent with ProtonMail, OpenPGP key 0x7E6761563EFE3930
> _______________________________________________
> openpgp mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/openpgp

-- 
Simo Sorce
Distinguished Engineer
RHEL Crypto Team
Red Hat, Inc