[Pqc] Re: [Ext] [cfrg] China has just released "Announcement on Launching the Next-generation Commercial Cryptographic Algorithms Program (NGCC)"

["D. J. Bernstein" <[e-mail]>]

Blumenthal, Uri - 0553 - MITLL writes:
> I find it hard to believe that this NICCS competition would result in
> an algorithm as secure as, e.g., Classic McEliece, or as efficient as,
> e.g., ML-KEM.

There are already various lattice proposals that are more efficient than
Kyber-512. See my posting

    https://mailarchive.ietf.org/arch/msg/tls/fjGGsHH0b9DOTqU710gN5PKfDJk/

for cost quantification for two examples. In short, BAT-512 costs less
than Kyber-512 as soon as a key is used a few dozen times, and smaugt1
costs less than Kyber-512 even if a key is used just once.

I should emphasize that BAT-512, smaugt1, Kyber-512, and various other
lattice proposals are bleeding-edge proposals. Lattice cryptanalysis is
unstable, and further breaks will be unsurprising. Of course, one hopes
that the cliff will stop crumbling at some point, and _maybe_ that point
will happen to be with Kyber-512 or Kyber-768 or Kyber-1024 standing
exactly at the edge while every lower-cost proposal has been broken.

---D. J. Bernstein