Re: [pkix] [saag] Applied Quantum Resistant Crypto

"Diego R. Lopez" <> Tue, 17 July 2018 20:50 UTC

Return-Path: <>
Received: from localhost (localhost []) by (Postfix) with ESMTP id 40C6C130E13; Tue, 17 Jul 2018 13:50:17 -0700 (PDT)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: -1.91
X-Spam-Status: No, score=-1.91 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, T_DKIMWL_WL_MED=-0.01] autolearn=unavailable autolearn_force=no
Authentication-Results: (amavisd-new); dkim=pass (1024-bit key)
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id nuyqUNYA_e5U; Tue, 17 Jul 2018 13:50:06 -0700 (PDT)
Received: from ( [IPv6:2a01:111:f400:fe05::724]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by (Postfix) with ESMTPS id 08136131058; Tue, 17 Jul 2018 13:49:53 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;; s=selector1-telefonica-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=UKBEN4wdqH3LdXBwwUiTTTQTehVjKIshxPXErGjh8/A=; b=KKrjfrssTuXZSR7Ou9yF5YV7Q+qLAboKDMnxRXFBBgYxHuu3iICG0yZmlfY+uIQp+kAk0sjGccEx99vlOmNyTZXPMfDKDTfgM98cdO+L8war2urCdBkGzbHuOjblbTU/OCkBKaKVG6u5pA7loDwNzkLLwRifKatRSIYy1OfUMPk=
Received: from ( by ( with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.952.18; Tue, 17 Jul 2018 20:49:50 +0000
Received: from ([fe80::d8e6:efcd:7512:d84c]) by ([fe80::d8e6:efcd:7512:d84c%2]) with mapi id 15.20.0952.021; Tue, 17 Jul 2018 20:49:50 +0000
From: "Diego R. Lopez" <>
To: "Dr. Pala" <>, "" <>, PKIX <>, "" <>
Thread-Topic: [saag] Applied Quantum Resistant Crypto
Thread-Index: AQHUHgVu3hmSIMpoF0yjiFG8TaLTU6SToE6A
Date: Tue, 17 Jul 2018 20:49:50 +0000
Message-ID: <>
References: <>
In-Reply-To: <>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach: yes
user-agent: Microsoft-MacOutlook/10.f.0.180709
authentication-results: spf=none (sender IP is );
x-originating-ip: [2001:67c:370:128:88df:b867:43a1:7968]
x-ms-publictraffictype: Email
x-microsoft-exchange-diagnostics: 1; DB3PR0602MB3675; 7:i72M4fpp6ymCahKUJcZgcfZVFIlUypYaxzQvdTRALSs2aj3wf0JxjvVPlK9TL5GPGPghQZIFzRCQS14FF10ImKeMsXHgMZTNxXHrkq2cX7eKdDU9OiW6c7yN1bytDTz6zANEjHK3nC3WCoZDXg6m8YtfYEg+ookdUGszXEz1zpS5v/apFN2m0YVj21M1i6T+zcHCdu/Sl85TQuu96rLas6NM7nyE7ijP/FeLKPFIjrB2RrIWqp2GeFvAGac/PXV+
x-ms-exchange-antispam-srfa-diagnostics: SOS;SOR;
x-ms-office365-filtering-correlation-id: 519acac1-1d8e-46de-21cc-08d5ec26d705
x-ms-office365-filtering-ht: Tenant
x-microsoft-antispam: UriScan:(40392960112811); BCL:0; PCL:0; RULEID:(7020095)(4652040)(8989117)(5600053)(711020)(4534165)(4627221)(201703031133081)(201702281549075)(8990107)(48565401081)(2017052603328)(7153060)(49563074)(7193020); SRVR:DB3PR0602MB3675;
x-ms-traffictypediagnostic: DB3PR0602MB3675:
x-microsoft-antispam-prvs: <>
x-exchange-antispam-report-test: UriScan:(28532068793085)(40392960112811)(65766998875637)(278428928389397)(120809045254105)(166708455590820)(223705240517415)(128460861657000)(131022147185803)(21748063052155);
x-ms-exchange-senderadcheck: 1
x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(8211001083)(102415395)(6040522)(2401047)(5005006)(8121501046)(3002001)(10201501046)(3231311)(944501410)(52105095)(93006095)(93001095)(6055026)(149027)(150027)(6041310)(20161123562045)(20161123558120)(20161123560045)(201703131423095)(201702281529075)(201702281528075)(20161123555045)(201703061421075)(201703061406153)(20161123564045)(6072148)(201708071742011)(7699016); SRVR:DB3PR0602MB3675; BCL:0; PCL:0; RULEID:; SRVR:DB3PR0602MB3675;
x-forefront-prvs: 073631BD3D
x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(376002)(136003)(39860400002)(396003)(346002)(366004)(25724002)(53754006)(189003)(199004)(252514010)(40134004)(6506007)(186003)(58126008)(68736007)(76176011)(106356001)(105586002)(53546011)(316002)(486006)(99286004)(2616005)(102836004)(110136005)(786003)(33656002)(478600001)(54906003)(476003)(45080400002)(99936001)(7736002)(46003)(446003)(11346002)(6116002)(790700001)(36756003)(8676002)(81156014)(8936002)(5660300001)(81166006)(6486002)(14454004)(966005)(97736004)(2906002)(82746002)(53936002)(4326008)(25786009)(236005)(54896002)(6306002)(54556002)(6512007)(53376002)(6246003)(2900100001)(733005)(6436002)(229853002)(14444005)(2501003)(83716003)(5250100002)(256004)(606006)(86362001); DIR:OUT; SFP:1102; SCL:1; SRVR:DB3PR0602MB3675;; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; MX:1; A:1;
received-spf: None ( does not designate permitted sender hosts)
x-microsoft-antispam-message-info: g496EoWsfU7aazMigxtmwHohVNgIdGkuWBVrFdn4Dk6ePEyKLvV03YfdTaV7tPt+z56pF6oWM0ca7oe94ANC60hrV5VTolXt4h0p7G1v7/izFQWAYlEDoP/ssqt5NkBxUvshoDY/jh/Ghv5EEkHPXuyU6JTZCgKrL6Qb5+p12POo/rwj1PWKMoywg+/yoEu0nH0TXDiY91wYuH4Y79h+mKcBKVRREG0mmnaeGsnnKEShkox9MAgnQSsfuNM00+kPqW+EqjfjuPvHCCzS7gV+PtqBw5RHyQcD/5+PYMQqoV2nf261ztrPoCL7feDv6/NIJWPdRsc3H1xWu+w7xQmjvDdQPlVdMHwED8ZLXZXuswc=
spamdiagnosticoutput: 1:99
spamdiagnosticmetadata: NSPM
Content-Type: multipart/related; boundary="_004_7A32408B4AF545589F5E5DFB5FEDFA39telefonicacom_"; type="multipart/alternative"
MIME-Version: 1.0
X-MS-Exchange-CrossTenant-Network-Message-Id: 519acac1-1d8e-46de-21cc-08d5ec26d705
X-MS-Exchange-CrossTenant-originalarrivaltime: 17 Jul 2018 20:49:50.2362 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 9744600e-3e04-492e-baa1-25ec245c6f10
X-MS-Exchange-Transport-CrossTenantHeadersStamped: DB3PR0602MB3675
Archived-At: <>
Subject: Re: [pkix] [saag] Applied Quantum Resistant Crypto
X-Mailman-Version: 2.1.27
Precedence: list
List-Id: PKIX Working Group <>
List-Unsubscribe: <>, <>
List-Archive: <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>
X-List-Received-Date: Tue, 17 Jul 2018 20:50:20 -0000


We have started some work in enabling key distribution schemas powered by QKD, that I believe could be applicable to post-quantum or QRC as well. So, yes, definitely interested in exploring those ways.

Be goode,

"Esta vez no fallaremos, Doctor Infierno"

Dr Diego R. Lopez
Telefonica I+D

Tel:         +34 913 129 041
Mobile:  +34 682 051 091

On 17/07/2018, 15:36, "saag on behalf of Dr. Pala" <<> on behalf of<>> wrote:

Hi all,

I was wondering if there are people interested in setting up some sort of discussion forum where to discuss the deployment (from a practical point of view) for QRC in their systems. The intent here would be to share the experiences, provide feedback, and possibly even share implementations/references/etc.

Moreover, being this quite a new field when it comes to real-world applications, it would be interesting to understand the new requirements so that we can plan for algorithm agility correctly and not having to go through what we suffered in the past (and in some cases with current protocols) to upgrade/switch among different schemes/algorithms.

For example, some of the topics might include:
·         How to deploy PKI services
·         Mixed environments considerations (QRC and "Traditional" Crypto)
·         Mixed environments (stateful vs. stateless)
·         Encryption and Key-Exchange for QRC - what are the options there (it seems auth is well understood, but other problems are still open)?
·         Are there implications for the deployment of PKIs we need to be aware of and are not currently mentioned/addressed?
·         Any real-world deployment out there (or plans for it)?
·         Algorithm Agility, what to plan for?
·         Applicability to Revocation Services

Most of the activities to standardize QRC in CMS/SecFirmware/etc. that I can see are related to the use of Stateful HASHSIG and I have not seen any "standardization" activities around stateless schemes (e.g., SPHINCS), but if I am wrong, please let me know (and if you could provide some interesting links, that would be great). I think it would be useful to understand how to practically deploy these new schemes and how to refine / provide the building blocks required for their implementation and deployment.

Here's some references:

Merkle Tree Signatures (Stateful):
· (XMSS)
· (Viability of Post Quantum X.509 Certs Paper)
·         Implementations:

SPHINCS Related (Stateless):
·         Implementations:

Other Relevant Links:

I guess this is all for now - you can reply privately at the following addresses:<><>

Best Regards,
Massimiliano Pala, Ph.D.
OpenCA Labs Director
[OpenCA Logo]


Este mensaje y sus adjuntos se dirigen exclusivamente a su destinatario, puede contener información privilegiada o confidencial y es para uso exclusivo de la persona o entidad de destino. Si no es usted. el destinatario indicado, queda notificado de que la lectura, utilización, divulgación y/o copia sin autorización puede estar prohibida en virtud de la legislación vigente. Si ha recibido este mensaje por error, le rogamos que nos lo comunique inmediatamente por esta misma vía y proceda a su destrucción.

The information contained in this transmission is privileged and confidential information intended only for the use of the individual or entity named above. If the reader of this message is not the intended recipient, you are hereby notified that any dissemination, distribution or copying of this communication is strictly prohibited. If you have received this transmission in error, do not read it. Please immediately reply to the sender that you have received this communication in error and then delete it.

Esta mensagem e seus anexos se dirigem exclusivamente ao seu destinatário, pode conter informação privilegiada ou confidencial e é para uso exclusivo da pessoa ou entidade de destino. Se não é vossa senhoria o destinatário indicado, fica notificado de que a leitura, utilização, divulgação e/ou cópia sem autorização pode estar proibida em virtude da legislação vigente. Se recebeu esta mensagem por erro, rogamos-lhe que nos o comunique imediatamente por esta mesma via e proceda a sua destruição