[openpgp] Re: Storing post-quantum keys for use in openpgp

[Phillip Hallam-Baker <[e-mail]>]

I would say definitely do seeds, not the expanded private. You can easily
go from seed to private but not vice versa.

A device can easily support really strong storage for 128 32 bit seeds, it
is only 4K or so.

Storing just one KEM key is 1632 to 3168 bytes and that is going to matter.

I expect such devices to become ubiquitous over the lifetime of this
version of the spec.



On Thu, Aug 22, 2024 at 12:30 PM Robert Lee <robert.lee=
[e-mail]> wrote:

> Hello all,
>
>
> In amongst the efforts for standardising post-quantum cryptography in
> openPGP we'll need to also consider how to store the new post-quantum
> secure keys in PGP private key blocks.
>
>
> In the latest Crypto Dispatch by Filippo Valsorda [1], he proposes
> implementors of post-quantum crypto ignore the existence of the proposed
> serialisation format for decapsulation keys in favour of only using seeds
> as the storage format for ML-KEM keys.
>
>
> Is this something that could/should be adopted in openpgp or not?  I
> found the arguments in favour of only using seeds convincing, I also like
> anything that can remove complexity where possible.  However, I accept that
> there may be reasons why this is not practical in openpgp?  I look
> forward to hearing what others think.
>
>
> Best Regards,
>
> Rob Lee
>
>
> [1] https://words.filippo.io/dispatches/ml-kem-seeds/
> _______________________________________________
> openpgp mailing list -- [e-mail]
> To unsubscribe send an email to [e-mail]
>