[Pqc] FW: [pqc-forum] object formats in NIST PQC standards

[Mike Ounsworth <[e-mail]>]

I’m cross-posting this question to the NIST PQC Forum about whether standardize binary encodings for public keys, signatures, and ciphertexts, which has implications for how IETF handles the uni-qsckeys drafts.


Direct link:
https://groups.google.com/a/list.nist.gov/g/pqc-forum/c/SM7KcTE7Cpo

---
Mike Ounsworth

From: 'Mike Ounsworth' via pqc-forum <[e-mail]>
Sent: Wednesday, April 26, 2023 1:11 PM
To: Perlner, Ray A. (Fed) <[e-mail]>; Falko Strenzke <[e-mail]>; pqc-forum <[e-mail]>
Cc: Evangelos Karatsiolis <[e-mail]>
Subject: [EXTERNAL] RE: [pqc-forum] object formats in NIST PQC standards

WARNING: This email originated outside of Entrust.
DO NOT CLICK links or attachments unless you trust the sender and know the content is safe.
________________________________
Thanks for asking this question Falko.


Ray,

Within the IETF we have the “uni-qsckeys” drafts floating around which provide encodings for the PQC finalists.

https://datatracker.ietf.org/doc/draft-uni-qsckeys-kyber/<https://urldefense.com/v3/__https:/datatracker.ietf.org/doc/draft-uni-qsckeys-kyber/__;!!FJ-Y8qCqXTj2!YyNnMZRH-XkBEIa9bdBahpbOc9-7b9nQl-rjnSbHb4t65Lfp55dytEDHsDhDDiBOe9eC2N4-TDwyrUPbPaP2d7IslC-k$>
https://datatracker.ietf.org/doc/draft-uni-qsckeys-dilithium/<https://urldefense.com/v3/__https:/datatracker.ietf.org/doc/draft-uni-qsckeys-dilithium/__;!!FJ-Y8qCqXTj2!YyNnMZRH-XkBEIa9bdBahpbOc9-7b9nQl-rjnSbHb4t65Lfp55dytEDHsDhDDiBOe9eC2N4-TDwyrUPbPaP2d_dMN69x$>
https://datatracker.ietf.org/doc/draft-uni-qsckeys-falcon/<https://urldefense.com/v3/__https:/datatracker.ietf.org/doc/draft-uni-qsckeys-falcon/__;!!FJ-Y8qCqXTj2!YyNnMZRH-XkBEIa9bdBahpbOc9-7b9nQl-rjnSbHb4t65Lfp55dytEDHsDhDDiBOe9eC2N4-TDwyrUPbPaP2dzPWXrbl$>
https://datatracker.ietf.org/doc/draft-uni-qsckeys-sphincsplus/<https://urldefense.com/v3/__https:/datatracker.ietf.org/doc/draft-uni-qsckeys-sphincsplus/__;!!FJ-Y8qCqXTj2!YyNnMZRH-XkBEIa9bdBahpbOc9-7b9nQl-rjnSbHb4t65Lfp55dytEDHsDhDDiBOe9eC2N4-TDwyrUPbPaP2d418RMRH$>

Quoting one of their abstracts:


Abstract

This proposal defines key management approaches for the Quantum Safe Cryptographic (QSC) algorithm CRYSTALS-Kyber which has been selected for standardization by the NIST Post Quantum Cryptography (PQC) process. This includes key identification, key serialization, and key compression. The purpose is to provide guidance such that the adoption of quantum safe algorithms is not hampered with the fragmented evolution of necessary key management standards. Early definition of key material standards will help expedite the adoption of new quantum safe algorithms and at the same time as improving interoperability between implementations and minimizing divergence across standards.


These has been some confusion about whether NIST will provide “official” public key, signature, and ciphertext encodings, or whether 3rd party standards like this will be necessary. As Falko said, there has been some controversy around these drafts, one of which being that the authors chose an ASN.1-based encoding which is a bit of an odd choice given the number of non-ASN.1-based crypto protocols in existence (like JOSE / COSE).


So back to the question, Ray, you are confirming that NIST will provide concrete binary encodings in the final PQC algorithm standards, thus making drafts like these obsolete?


---
Mike Ounsworth
Software Security Architect, Entrust

From: 'Perlner, Ray A. (Fed)' via pqc-forum <[e-mail]<mailto:[e-mail]>>
Sent: Wednesday, April 26, 2023 12:51 PM
To: Falko Strenzke <[e-mail]<mailto:[e-mail]>>; pqc-forum <[e-mail]<mailto:[e-mail]>>
Cc: Evangelos Karatsiolis <[e-mail]<mailto:[e-mail]>>
Subject: [EXTERNAL] RE: [pqc-forum] object formats in NIST PQC standards

WARNING: This email originated outside of Entrust.
DO NOT CLICK links or attachments unless you trust the sender and know the content is safe.
________________________________
Hi Falko

Our (NIST’s) current plan is to encode signatures, ciphertexts, and public keys as byte strings. I think this is closest to (A) from your list.

-Ray Perlner



From: [e-mail]<mailto:[e-mail]> <[e-mail]<mailto:[e-mail]>> On Behalf Of Falko Strenzke
Sent: Tuesday, April 25, 2023 5:25 AM
To: pqc-forum <[e-mail]<mailto:[e-mail]>>
Cc: Evangelos Karatsiolis <[e-mail]<mailto:[e-mail]>>
Subject: [pqc-forum] object formats in NIST PQC standards


I have the following question to NIST: What are the input/output formats of public keys, ciphertexts and signatures that can be expected in the NIST PQC standards? What I mean is the general distinction between

  *   (A) opaque binary blobs (as they are currently used by the reference implementations)
  *   (B) a somewhat structured format,
     *   (i) e.g. defining the keys as lists of elements (such as pk = (A, t) in case of Dilithium public keys) without providing an encompassing encoding
     *   (ii) defining such lists/sequences of elements with some kind of encompassing encoding (e.g. length encoding of some kind)

The background of this question is that we observed that in the LAMPS PQC drafts for the hash-based schemes an ASN.1 encoding is prescribed for the internal structuring of public keys and signatures. See our posts on the LAMPS mailing list for what is our concern here.

- Falko
--

MTG AG
Dr. Falko Strenzke
Executive System Architect

Phone: [phone]
E-Mail: [e-mail]<mailto:[e-mail]>
Web: mtg.de<https://urldefense.com/v3/__https:/www.mtg.de__;!!FJ-Y8qCqXTj2!fBnfyrGjeXDg9zUDuHejrdbPb7SBvvf5Rcs2_uOn9qiOJeqfCdznB8KEvTdYNS6uE4VDkTO2X6JpYM_Vs5nY0qcfU1HL$>


MTG Exhibitions – See you in 2023

________________________________
[cid:image001.png@01D9783F.2D6B9BC0]<https://urldefense.com/v3/__https:/community.e-world-essen.com/institutions/allExhibitors?query=true&keywords=mtg__;!!FJ-Y8qCqXTj2!fBnfyrGjeXDg9zUDuHejrdbPb7SBvvf5Rcs2_uOn9qiOJeqfCdznB8KEvTdYNS6uE4VDkTO2X6JpYM_Vs5nY0hSuLWGq$>[cid:image002.png@01D9783F.2D6B9BC0]<https://urldefense.com/v3/__https:/www.itsa365.de/de-de/companies/m/mtg-ag__;!!FJ-Y8qCqXTj2!fBnfyrGjeXDg9zUDuHejrdbPb7SBvvf5Rcs2_uOn9qiOJeqfCdznB8KEvTdYNS6uE4VDkTO2X6JpYM_Vs5nY0n84Mhdc$>

MTG AG - Dolivostr. 11 - 64293 Darmstadt, Germany
Commercial register: HRB 8901
Register Court: Amtsgericht Darmstadt
Management Board: Jürgen Ruf (CEO), Tamer Kemeröz
Chairman of the Supervisory Board: Dr. Thomas Milde

This email may contain confidential and/or privileged information. If you are not the correct recipient or have received this email in error,
please inform the sender immediately and delete this email. Unauthorised copying or distribution of this email is not permitted.

Data protection information: Privacy policy<https://urldefense.com/v3/__https:/www.mtg.de/en/privacy-policy__;!!FJ-Y8qCqXTj2!fBnfyrGjeXDg9zUDuHejrdbPb7SBvvf5Rcs2_uOn9qiOJeqfCdznB8KEvTdYNS6uE4VDkTO2X6JpYM_Vs5nY0kFHxZnc$>
--
You received this message because you are subscribed to the Google Groups "pqc-forum" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [e-mail]<mailto:[e-mail]>.
To view this discussion on the web visit https://groups.google.com/a/list.nist.gov/d/msgid/pqc-forum/88002f84-4f6a-b2cd-9614-fc709c6a9942%40mtg.de<https://urldefense.com/v3/__https:/groups.google.com/a/list.nist.gov/d/msgid/pqc-forum/88002f84-4f6a-b2cd-9614-fc709c6a9942*40mtg.de?utm_medium=email&utm_source=footer__;JQ!!FJ-Y8qCqXTj2!fBnfyrGjeXDg9zUDuHejrdbPb7SBvvf5Rcs2_uOn9qiOJeqfCdznB8KEvTdYNS6uE4VDkTO2X6JpYM_Vs5nY0sIYmabW$>.
--
You received this message because you are subscribed to the Google Groups "pqc-forum" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [e-mail]<mailto:[e-mail]>.
To view this discussion on the web visit https://groups.google.com/a/list.nist.gov/d/msgid/pqc-forum/DM6PR09MB4855CB0CEDB3AA2EF66A4F529C659%40DM6PR09MB4855.namprd09.prod.outlook.com<https://urldefense.com/v3/__https:/groups.google.com/a/list.nist.gov/d/msgid/pqc-forum/DM6PR09MB4855CB0CEDB3AA2EF66A4F529C659*40DM6PR09MB4855.namprd09.prod.outlook.com?utm_medium=email&utm_source=footer__;JQ!!FJ-Y8qCqXTj2!fBnfyrGjeXDg9zUDuHejrdbPb7SBvvf5Rcs2_uOn9qiOJeqfCdznB8KEvTdYNS6uE4VDkTO2X6JpYM_Vs5nY0gfVdwjj$>.
Any email and files/attachments transmitted with it are confidential and are intended solely for the use of the individual or entity to whom they are addressed. If this message has been sent to you in error, you must not copy, distribute or disclose of the information it contains. Please notify Entrust immediately and delete the message from your system.
--
You received this message because you are subscribed to the Google Groups "pqc-forum" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [e-mail]<mailto:[e-mail]>.
To view this discussion on the web visit https://groups.google.com/a/list.nist.gov/d/msgid/pqc-forum/CH0PR11MB5739049A54A61C94FC70377F9F659%40CH0PR11MB5739.namprd11.prod.outlook.com<https://urldefense.com/v3/__https:/groups.google.com/a/list.nist.gov/d/msgid/pqc-forum/CH0PR11MB5739049A54A61C94FC70377F9F659*40CH0PR11MB5739.namprd11.prod.outlook.com?utm_medium=email&utm_source=footer__;JQ!!FJ-Y8qCqXTj2!YyNnMZRH-XkBEIa9bdBahpbOc9-7b9nQl-rjnSbHb4t65Lfp55dytEDHsDhDDiBOe9eC2N4-TDwyrUPbPaP2dwDUy1fj$>.