Re: [Pqc] [Ext] Mapping the state of PQC and IETF

[Alexandre Petrescu <[e-mail]>]

Le 27/02/2023 à 16:58, Paul Hoffman a écrit :
> On Feb 27, 2023, at 7:46 AM, Sofía Celi <[e-mail]> 
> wrote:
>> We have started work on mapping the state of PQC (if any draft or 
>> RFC exists) in the different IETF protocols/WG and IRTF groups: 
>> https://github.com/ietf-wg-pquip/state-of-protocols-and-pqc to
>> keep track of where everything is at. Feel free to contribute by
>> sending a PR. We hope this list is useful to many.
> 
> Or, if you're not comfortable with opening GitHub pull requests,
> feel free to open an issue on the tracker or just post something here
> on the list!

Thanks for the list of drafts and RFC about PQC at IETF - impressive,
already 19 documents.

I am not a crypto expert, sorry if I say naive things.

One question that comes up in some discussions in other IETF groups is
related to the need (or no need) to upgrade to quantum resistance some
IETF methods that generate parts of an IP address.

For example, RFC3972 'CGAs' (crypto generated addresses) uses a lengthy
algorithm involving SHA-1; this RFC is then further used by LISP RFC,
among others.

Would there be any risk in LISP using these CGAs, and thus would there
be a need to migrate to quantum-resistant algorithms?

The same kind of question applies to other RFCs for other protocols such
as the return routability tests for MIP6, and others, perhaps HIP.

I am also wondering about the use of algorithms such as MD5 or SHAx to
generate random - probably unique - numbers (e.g. ULA generation method
in RFC4193).  Would they be at risk in that randomness (risk of
duplicates), currently, or not.  Would they need to be migrated to
quantum resistance; would these new algos be better at generating
uniqueness?

This question of need - is there any need of quantum-resistance in this
or that particular context - is very important in many places.  Without
more definite agreements there would be no migration in the immediate.

It might that there is no currently perceived need, but would rather
need to move to quantum resistance because all others do, if one wants
to stay interoperable.

It might be that there is no currently perceived need, and one should
not move to quantum resistance currently because that involves too much
energy and compute consumption.

Alex

> 
> --Paul Hoffman
>