Re: [Pqc] Listing pointers to not-yet-standardized PQC algorithms

["Blumenthal, Uri - 0553 - MITLL" <[e-mail]>]

I vote with Panos here. No to both.

--
V/R,
Uri
 
There are two ways to design a system. One is to make it so simple there are obviously no deficiencies.
The other is to make it so complex there are no obvious deficiencies.
                                                                                                                                     -  C. A. R. Hoare
 

On 5/3/23, 21:59, "Pqc on behalf of Kampanakis, Panos" <[e-mail] on behalf of kpanos=[e-mail]> wrote:

    I would vote no to both. 

    1. Crypto developers are following NIST's work and there are plenty of resources that explain what these algorithms are. I don't see a benefit in encyclopedically documenting something that have been documented many times before. 

    2. Frodo is in the LWE family. It is not RLWE or MLWE, so as a primitive it has less structure and could be assumed to be more conservatively secure, but it is in the lattice family like Kyber. The Frodo public key and ciphertext are pretty big. NIST's schemes offer better size-performance balance and math primitive family diversity. IETF should only go with primitives that make sense for use in its WGs. I am not sure I would pick Frodo over Kyber or BIKE in any use-cases. Personally, I expect and hope that European regulatory bodies will endorse NIST's primitives in the long run as well. 



    -----Original Message-----
    From: Pqc <[e-mail]> On Behalf Of Paul Hoffman
    Sent: Wednesday, May 3, 2023 6:57 PM
    To: [e-mail]
    Subject: [EXTERNAL] [Pqc] Listing pointers to not-yet-standardized PQC algorithms

    CAUTION: This email originated from outside of the organization. Do not click links or open attachments unless you can confirm the sender and know the content is safe.



    Greetings again. The grand list of pointers at <https://github.com/ietf-wg-pquip/state-of-protocols-and-pqc> primarily lists Internet Drafts and RFCs.

    We know that the protocols themselves are being developed elsewhere, primarily (but not exclusively) at NIST. NIST has said that it will publish standards for CRYSTALS-Kyber, CRYSTALs-Dilithium, Falcon, and SPHINX+ next year, and has more informally said that it will publish standards for other KEM finalists (Classic McEliece, BIKE, and HQC). Should this WG help let IETF developers know about these algorithms and their status at NIST; if so, how?

    Those of us following the European PQC world know that there is still a lot of interest in some non-NIST algorithms, particularly FrodoKEM. FrodoKEM is being standardized in ISO. Should this WG let IETF developers know about these algorithms? If so, how do we bound this list to prevent us from promoting MyMostlyUnreviewedKEM without enough context?

    --Paul Hoffman