[openpgp] Re: Fw: New Version Notification for draft-ietf-openpgp-pqc-05.txt

[Simo Sorce <[e-mail]>]

Hi Aaron,

great work on the update!

That said I have to ask is there is apce for adding NIST ECC curves
here.

While Ed25519/Ed448 have been recently approved for use in FIPS modules
via revision 5 of FIPS-186 there is yet no approval for the use of
X25519/X448 as SP 800-56A has not been extended to cover them.

It would be useful if at least one KEM option would be defined using
NIST curves for the classic algorithm part.

Ideally bot KEM and Signatures can use the classic NIST approved
curves, as adding an Edwards curve implementation to existing modules
may not be trivial and time would be better spent properly implementing
ML-DSA and ML-KEM while reusing a proven and hardened P256/P384/P521
implementation for the classic part.

I understand the desire to avoid too many combinations, but a standard
should also look at the practicalities of deployment IMHO.

HTH,
Simo.

On Mon, 2024-10-21 at 15:35 +0000, Aron Wussler wrote:
> Hi everyone,
> 
> We just published the new version of the draft, including all the changes promised at the last meeting. 
> 
> 
> In particular, here's the changelog:
>    *  Reworked KEM combiner for the purpose of NIST-compliance.
>    *  Mandated v6 keys for ML-KEM + ECDH algorithms.
>    *  Defined private key seed format for ML-KEM and ML-DSA.
>    *  Added key generation security considerations.
>    *  Replaced initial public drafts with FIPS 203, 204, 205.
> 
> The test vectors are up-to-date, and we encourage everyone to have a look at it, or even better try to implement it.
> 
> Cheers,
> Aron
> 
> 
> 
> --
> Aron Wussler
> Sent with ProtonMail, OpenPGP key 0x7E6761563EFE3930
> 
> 
> 
> ------- Forwarded Message -------
> From: [e-mail] <[e-mail]>
> Date: On Monday, 21 October 2024 at 17:31
> Subject: New Version Notification for draft-ietf-openpgp-pqc-05.txt
> To: Aron Wussler <[e-mail]>, Falko Strenzke <[e-mail]>, Johannes Roth <[e-mail]>, Stavros Kousidis <[e-mail]>
> 
> 
> > A new version of Internet-Draft draft-ietf-openpgp-pqc-05.txt has been
> > successfully submitted by Aron Wussler and posted to the
> > IETF repository.
> > 
> 
> > Name: draft-ietf-openpgp-pqc
> > Revision: 05
> > Title: Post-Quantum Cryptography in OpenPGP
> > Date: 2024-10-21
> > Group: openpgp
> > Pages: 59
> > URL: https://www.ietf.org/archive/id/draft-ietf-openpgp-pqc-05.txt
> > Status: https://datatracker.ietf.org/doc/draft-ietf-openpgp-pqc/
> > HTML: https://www.ietf.org/archive/id/draft-ietf-openpgp-pqc-05.html
> > HTMLized: https://datatracker.ietf.org/doc/html/draft-ietf-openpgp-pqc
> > Diff: https://author-tools.ietf.org/iddiff?url2=draft-ietf-openpgp-pqc-05
> > 
> 
> > Abstract:
> > 
> 
> > This document defines a post-quantum public-key algorithm extension
> > for the OpenPGP protocol. Given the generally assumed threat of a
> > cryptographically relevant quantum computer, this extension provides
> > a basis for long-term secure OpenPGP signatures and ciphertexts.
> > Specifically, it defines composite public-key encryption based on ML-
> > KEM (formerly CRYSTALS-Kyber), composite public-key signatures based
> > on ML-DSA (formerly CRYSTALS-Dilithium), both in combination with
> > elliptic curve cryptography, and SLH-DSA (formerly SPHINCS+) as a
> > standalone public key signature scheme.
> > 
> 
> > 
> 
> > 
> 
> > The IETF Secretariat

-- 
Simo Sorce
Distinguished Engineer
RHEL Crypto Team
Red Hat, Inc