Re: [Pqc] [Ext] NIST requests comments on the initial public drafts of three PQC algorithm standards

[Phillip Hallam-Baker <[e-mail]>]

On Thu, Aug 24, 2023 at 12:15 PM Paul Hoffman <[e-mail]>
wrote:

> A few significant notes for the WG (and the IETF in general):
>


> - These are proposals for standardization, not the standards. NIST will
> likely get a lot of responses to the call for comments, and may change the
> technical parts of the algorithms based on those comments. We'll know more
> by mid-2024 when NIST issues the final standards.
>

The private key format in particular might be changed.

Public key sizes are constrained by the need to communicate information and
Kyber is having to communicate quite a bit.

Private key information is different, there is never a need to specify more
than an n bit seed and a deterministic generation mechanism. While
generating RSA keys is tedious and time consuming, generating these keys
does not require the same degree of trial and error.

For example, the following UDF specifies an RSA-2048 keypair:

ZAAA-RJ5I-OSMI-X2KH-MBHX-KUPB-OC54-NQI


Details of the derivation process are at:

https://datatracker.ietf.org/doc/draft-hallambaker-mesh-udf/

Of course, for most processes, you would want a much bigger seed. I will
add ML-KEM and ML-DSA once there is a final spec.


Another area where there is a lot of scope for kibitzing is the mechanism
used to populate the matrix which doesn't actually change the security of
the algorithm but when I was testing my code out on my own test vectors, I
was finding I was not always exercising all of my code paths. Which is not
ideal.

So I would hope and expect there to be changes which may (or may not) be
breaking changes.