Re: [Pqc] [Ext] [WG last call] IETF WG state changed for draft-ietf-pquip-pqt-hybrid-terminology

[Wang Guilin <[e-mail]>]

Dear Flo and all, 

I am happy to support adoption of draft-ietf-pquip-pqt-hybrid-terminology. 

I have read the draft several times and also given my feedback. So, from my viewpoint, the content seems quite good now. 

======================
About this version, my detailed comment is still on the definition of *Traditional Cryptographic Algorithm*. Namely, it seems still too narrow, not exactly the opposite of *Post-Quantum Algorithm*. 

Here is the current definition: 

"*Traditional Cryptographic Algorithm*:  An asymmetric cryptographic algorithm based on integer factorisation, finite field discrete logarithms, elliptic curve discrete logarithms, or related mathematical problems."

Happy to see this definition has been extended as asymmetric cryptographic algorithm based on factoring, DL or related mathematical problems, not just schemes based on factoring and DL problems, after communication with Flo. However, it seems still narrow. Namely, in logic, how can we show or conclude that Traditional Cryptographic Algorithms have only been built and also will be built only on factoring and DL related mathematical problems? A more natural definition may be something like the following (using similar expression for defining *Post-Quantum Algorithm* in [draft-ietf-pquip-pqt-hybrid-terminology]): 

*Traditional Cryptographic Algorithm*:  An asymmetric cryptographic algorithm that is designed to secure against attacks using classical computers, but not quantum computers. The representatives are  
cryptographic algorithms based on integer factorisation, finite field discrete logarithms, elliptic curve discrete logarithms, or related mathematical problems. For example, RSA, ECDSA, ECDH. 

In fact, this is similar for us not saying that Post-Quantum Algorithms just belong to five categories, as this is just what we have seen now. So, in future, some categories of Post-Quantum Algorithms may appear. Actually, this could happen to Traditional Cryptographic Algorithm as well. Namely, it is possible that someone may propose some totally new Traditional Cryptographic Algorithm based some new hard problem in the future. 

Another way to justify why the concept may need to be extended as the above is to show the existence of at least Traditional Cryptographic Algorithm, which is not based on factoring, DL or related mathematical problems. Especially, it will be even better if the algorithm is a standard or has been considered for standardization. 

For this purpose, I have checked this issue with a number of professors. Then, such an algorithm comes out: It is Algebraic Eraser (AE) Key Agreement Protocol (AEKAP). According to my quick check, I think AEKAP is a Traditional Cryptographic Algorithm, but not based on factoring, DL or related mathematical problems. 

Below is some related from WiKi and other sources for reference (I am not an expert on AEKAP and the related mathematical prolems): 
---------------------------------
1) Info from https://en.wikipedia.org/wiki/Algebraic_Eraser: 

"Algebraic Eraser (AE)[note 1] is an anonymous key agreement protocol that allows two parties, each having an AE public-private key pair, to establish a shared secret over an insecure channel.[1] This shared secret may be directly used as a key, or to derive another key that can then be used to encrypt subsequent communications using a symmetric key cipher. Algebraic Eraser was developed by Iris Anshel, Michael Anshel, Dorian Goldfeld and Stephane Lemieux. SecureRF owns patents covering the protocol[2] and unsuccessfully attempted (as of July 2019) to standardize the protocol as part of ISO/IEC 29167-20,[3] a standard for securing radio-frequency identification devices and wireless sensor networks.

The security of AE is based on the Generalized Simultaneous Conjugacy Search Problem (GSCSP)[4] within the braid group. This is a distinct and different hard problem than the Conjugacy Search Problem (CSP), which has been the central hard problem in what is called braid group cryptography.[5] Even if CSP is uniformly broken (which has not been done to date), it is not known how this would facilitate a break of GSCSP."

2. AEAKP once considered in IETF. 
Using Algebraic Eraser (AEDH) in OpenPGP
https://datatracker.ietf.org/doc/html/draft-atkins-openpgp-algebraic-eraser-05 

3. A paper on AEAKP
Algebraic EraserTM: A lightweight, efficient asymmetric key agreement protocol for use in no-power, low-power, and IoT devices. 
https://csrc.nist.gov/csrc/media/events/lightweight-cryptography-workshop-2015/documents/papers/session8-atkins-paper.pdf 
---------------------------
======================

Guilin

-----Original Message-----
From: Pqc <[e-mail]> On Behalf Of Flo D
Sent: Monday, 4 March 2024 4:53 pm
To: [e-mail]
Subject: Re: [Pqc] [Ext] [WG last call] IETF WG state changed for draft-ietf-pquip-pqt-hybrid-terminology

Hi PQUIP,

Thanks Paul and Sofía for this last call.  I'd like to second Paul's call to the group to use this as an opportunity to review the draft.  Even if you don't think the draft still needs more time, I think it's vital that we "bank" some of the definitions sooner rather than later.  We need to do that so that the protocol drafts that refer to this draft, and that will start to get published once NIST have finalised their standards, can rely on the definitions that are included here.

Thanks in advance,
Flo

-----Original Message-----
From: Pqc <[e-mail]> On Behalf Of Paul Hoffman
Sent: Friday, March 1, 2024 5:57 PM
To: [e-mail]
Subject: Re: [Pqc] [Ext] [WG last call] IETF WG state changed for draft-ietf-pquip-pqt-hybrid-terminology

A strong nudge that this document is in WG Last Call and needs a bunch more reviews, even if they just say "that's all fine".


On Feb 21, 2024, at 07:31, Sofía Celi <[e-mail]> wrote:

> Hi,
>
> This email starts the working group last call for "Terminology for Post-Quantum Traditional Hybrid Schemes" I-D, located here:
>
> https://datatracker.ietf.org/doc/draft-ietf-pquip-pqt-hybrid-terminology/
>
> The WG Last Call will end 6th March 2024 @ 2359 UTC.
>
> Please review the I-D and submit any comments to the [e-mail] mailing list.


--
Pqc mailing list
[e-mail]
https://www.ietf.org/mailman/listinfo/pqc

-- 
Pqc mailing list
[e-mail]
https://www.ietf.org/mailman/listinfo/pqc