[openpgp] PQC encryption algorithm selection

[Aron Wussler <[e-mail]>]

Hi everyone,

In the next weeks, before IETF 119, we'd like to collect feedback about the algorithm selection implemented in the draft [1]. We're interested in presenting some vectors for the next meeting. It would be great if you could provide feedback by March 1st.

To keep the discussion focused we're going to start from the encryption algorithm selection, KEM combiners will follow (since it may also depend on the algorithm selection). Digital signatures will also follow in another thread.

Right now, we have the following list of algorithms (in table 1)
    +====+===============================+=============+=============+
    | ID | Algorithm                     | Requirement | Definition  |
    +====+===============================+=============+=============+
    | 29 | ML-KEM-768 + X25519           | MUST        | Section 5.2 |
    +----+-------------------------------+-------------+-------------+
    | 30 | ML-KEM-1024 + X448            | SHOULD      | Section 5.2 |
    +----+-------------------------------+-------------+-------------+
    | 31 | ML-KEM-768 + ECDH-NIST-P-256  | MAY         | Section 5.2 |
    +----+-------------------------------+-------------+-------------+
    | 32 | ML-KEM-1024 + ECDH-NIST-P-384 | MAY         | Section 5.2 |
    +----+-------------------------------+-------------+-------------+
    | 33 | ML-KEM-768 + ECDH-            | MAY         | Section 5.2 |
    |    | brainpoolP256r1               |             |             |
    +----+-------------------------------+-------------+-------------+
    | 34 | ML-KEM-1024 + ECDH-           | MAY         | Section 5.2 |
    |    | brainpoolP384r1               |             |             |
    +----+-------------------------------+-------------+-------------+

Please provide feedback on the algorithms, and if you think they should be "MUST", "SHOULD", or "MAY". The proposed list is derived from the results of the NIST standardization process, hybrid with the curves already supported from OpenPGP for compliance purposes.

Finally, please note that this is not the sole opportunity to standardize PQC algorithms: as of the crypto-refresh, new algorithms will need a specification and designated expert review, and not an RFC.

Cheers and thanks,
Aron


[1] https://www.ietf.org/archive/id/draft-ietf-openpgp-pqc-00.html#name-algorithm-specifications

--
Aron Wussler
Sent with ProtonMail, OpenPGP key 0x7E6761563EFE3930