Re: [openpgp] PQC encryption algorithm selection

[Bart Butler <[e-mail]>]

I think everyone would love to just do 25519 and 448. The others (MAY) are there for compliance (NIST/BSI) if I'm not mistaken.

On Wednesday, February 7th, 2024 at 3:03 PM, Simo Sorce <[e-mail]> wrote:

> 

> 

> Hi Aron,
> Why so much redundancy in EC curves?
> 

> This is basically the same thing 3 times over, wouldn't it be more
> appropriate to just allow a singe EC curve family so there is no risk
> of interoperability issues between implementations ?
> 

> Simo.
> 

> On Wed, 2024-02-07 at 11:39 +0000, Aron Wussler wrote:
> 

> > Hi everyone,
> > 

> > In the next weeks, before IETF 119, we'd like to collect feedback about the algorithm selection implemented in the draft [1]. We're interested in presenting some vectors for the next meeting. It would be great if you could provide feedback by March 1st.
> > 

> > To keep the discussion focused we're going to start from the encryption algorithm selection, KEM combiners will follow (since it may also depend on the algorithm selection). Digital signatures will also follow in another thread.
> > 

> > Right now, we have the following list of algorithms (in table 1)
> > +====+===============================+=============+=============+
> > | ID | Algorithm | Requirement | Definition |
> > +====+===============================+=============+=============+
> > | 29 | ML-KEM-768 + X25519 | MUST | Section 5.2 |
> > +----+-------------------------------+-------------+-------------+
> > | 30 | ML-KEM-1024 + X448 | SHOULD | Section 5.2 |
> > +----+-------------------------------+-------------+-------------+
> > | 31 | ML-KEM-768 + ECDH-NIST-P-256 | MAY | Section 5.2 |
> > +----+-------------------------------+-------------+-------------+
> > | 32 | ML-KEM-1024 + ECDH-NIST-P-384 | MAY | Section 5.2 |
> > +----+-------------------------------+-------------+-------------+
> > | 33 | ML-KEM-768 + ECDH- | MAY | Section 5.2 |
> > | | brainpoolP256r1 | | |
> > +----+-------------------------------+-------------+-------------+
> > | 34 | ML-KEM-1024 + ECDH- | MAY | Section 5.2 |
> > | | brainpoolP384r1 | | |
> > +----+-------------------------------+-------------+-------------+
> > 

> > Please provide feedback on the algorithms, and if you think they should be "MUST", "SHOULD", or "MAY". The proposed list is derived from the results of the NIST standardization process, hybrid with the curves already supported from OpenPGP for compliance purposes.
> > 

> > Finally, please note that this is not the sole opportunity to standardize PQC algorithms: as of the crypto-refresh, new algorithms will need a specification and designated expert review, and not an RFC.
> > 

> > Cheers and thanks,
> > Aron
> > 

> > [1] https://www.ietf.org/archive/id/draft-ietf-openpgp-pqc-00.html#name-algorithm-specifications
> > 

> > --
> > Aron Wussler
> > Sent with ProtonMail, OpenPGP key 0x7E6761563EFE3930
> > _______________________________________________
> > openpgp mailing list
> > [e-mail]
> > https://www.ietf.org/mailman/listinfo/openpgp
> 

> 

> --
> Simo Sorce
> Distinguished Engineer
> RHEL Crypto Team
> Red Hat, Inc
> 

> 

> 

> 

> 

> 

> 

> 

> _______________________________________________
> openpgp mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/openpgp