Re: [Pqc] [Ext] Listing pointers to not-yet-standardized PQC algorithms

[Daniel Christopher Apon <[e-mail]>]

For that matter (my 2c), there seems to be no "post-quantum use in
protocols" material (taken at moral face-value, not by a line-by-line
reading of the charter) worth discussing when considering (i) approved
algorithms like Kyber or (potentially?) NTRU as compared to (ii)
non-approved algorithms like NTRU Prime. The protocol content is effectively
the same.

If e.g. some significant standardization body (fitting criteria broadly
accepted across IETF) approves FrodoKEM or NIST approves Classic McEliece
and/or one of {HQC, BIKE}, there would seem to be potentially more material
to discuss regarding their use in protocols -- sometime in the future, but
not currently.

--Daniel

-----Original Message-----
From: Pqc <[e-mail]> On Behalf Of Russ Housley
Sent: Tuesday, May 16, 2023 11:39 AM
To: Paul Hoffman <[e-mail]>
Cc: [e-mail]
Subject: Re: [Pqc] [Ext] Listing pointers to not-yet-standardized PQC
algorithms


> On May 15, 2023, at 2:53 PM, Paul Hoffman <[e-mail]> wrote:
> 
> On May 15, 2023, at 11:30 AM, D. J. Bernstein <[e-mail]> wrote:
>> 
>>>> Also, to clarify, are you saying it was out of PQUIP's scope for 
>>>> the UK NCSC to write "I think we should focus on the NIST algorithms"?
>>> People can choose what to focus their time and energy on within the 
>>> WG on things that are in scope.
>> 
>> Please clarify. If making "any choices of PQ algorithms" is supposed 
>> to be out of scope then how can "focus on the NIST algorithms" be in
scope?
> 
> I'll respond as one of the co-chairs. Anyone can contribute opinions to
the list. If the ensuing discussion goes far afield from the charter, then
it is the chair's responsibility to try to gently rein it back in.
> 
> There is a large difference between the WG making choices for other WGs
and us discussing how the other WGs make their choices. That was part of my
motivation for starting this thread. If one WG wants to wait for NIST to
standardize its first KEM before standardizing that WG's protocol, and
another WG wants to wait for NIST to standardize additional KEMs because
that WG knows now that it won't like the first KEM (even though that means
delaying and thus more traffic will be captured), and yet another WG wants
to standardize a non-NIST KEM for some reason (which might make finishing
the protocol go faster or slower): all of that is reasonable to discuss in
the PQUIP charter. In particular, discussing how delaying standardization
affects the amount of traffic captured is in scope.

The LAMPS WG charter sets the scope of PQ algorithms that can be considered.
They need to be NIST-approved or GFRG-approved. I hope we can have the same
criteria across the IETF.

Russ

--
Pqc mailing list
[e-mail]
https://www.ietf.org/mailman/listinfo/pqc