[openpgp] WGLC for draft-ietf-openpgp-pqc [was: Re: I-D Action: draft-ietf-openpgp-pqc-08.txt]

[Daniel Kahn Gillmor <[e-mail]>]

On Tue 2025-04-15 08:58:05 +0000, Aron Wussler wrote:
> At the OpenPGP Email Summit we discussed the PQC draft, and noticed that many are waiting on us to publish the latest state.
>
> We took action, and here's the latest version with all the changes we discussed at the recent meetings:
> - Assigned code points 35 and 36 for ML-KEM + ECDH algorithms: as discussed at the interim meeting and IETF 122
> - Removed hash binding for ML-DSA + EdDSA and SLH-DSA algorithms: as discussed on the list, we allow signatures to offer a SHA-2 prehash to remove a blocker for CNSA 2.0 compliance
> - Allowed usage of ML-KEM-768 + X25519 with v4 keys: as discussed at the OpenPGP summit, we decided to allow for a pq-upgrade path without rotating the primary key
> - Aligned KEM combiner to X-Wing and switched to suffix-free encoding of the domain separator: as presented at IETF 122 to further align with LAMPS

Thanks for this update, Aron, Falko, and Johannes!

With these changes, Stephen and I are announcing Working Group Last Call
on draft-ietf-openpgp-pqc.

We expect the WGLC to last four weeks, which means we will look for
consensus (or the lack thereof) based on on-list discusson through
Tuesday, 2025-05-13.

If you are implementing this draft, please report back here!

Even if you aren't implementing, if you have concerns or questions about
it, please also speak up.

It would also be great to update the PQC test vectors in the
interoperability test suite.  If anyone has the time or capacity to do
that, i've opened an issue:

    https://gitlab.com/sequoia-pgp/openpgp-interoperability-test-suite/-/issues/161

For the chairs,

    --dkg