Re: [openpgp] German BSI, PQC for OpenPGP in Thunderbird,

[Daniel Huigens <[e-mail]>]

Hi all,

For what it's worth, we (ProtonMail) were also planning to create an
experimental implementation of post-quantum crypto in OpenPGP, sometime
this fall - not intending to "create a standard", rather our rationale
was that an experimental implementation could teach us something about
a potential standardization in the future.

That being said, if the WG is ready for this work by then, we are of
course happy to contribute to that work, and collaborate on a potential
standardization while working on an experimental implementation.
Depending on when someone applies to this tender from the BSI, perhaps
they could do the same.

While it's of course up for debate, we had a similar set of algorithms
in mind to use for the experimental implementation (using a hybrid
approach of both post-quantum and classical algorithms). We do think
that it makes more sense to wait for NIST standardization for the final
standardization of PQC in OpenPGP - but even if the set of standardized
algorithms ends up being different, the high-level work might still
teach us something, so we are in principle not opposed to this work.

If someone applies to this tender before the WG is ready for this work,
we would hope / recommend that they take a similar approach as we were
planning, and create an experimental implementation that could inform,
but not define, the final specification. That being said, as soon as
this WG has the bandwidth to work on this, hopefully the person working
on that could join the WG and help draft a specification, and as I said
we would be happy to contribute to that effort as well.

Best regards,
Daniel Huigens