Re: [Pqc] Mapping the state of PQC and IETF - ssh

["Kampanakis, Panos" <[e-mail]>]

Hi Alex, 

OpenSSH supports X25519+SNTRU for some time now. SNTRU is a quantum-safe algorithm that got eliminated earlier in the NIST PQ process. There was nothing wrong with it, it just didn't move forward, so there will be no final spec for it. Also, OpenSSH currently does not support ECDH+PQ for "quantum-safe FIPS" compliance. 

Although it is a great that OpenSSH was an early adopter, in the long run it makes sense to standardize on a consensus-based, peer-reviewed spec instead of complying with the choices one widely-used implementation made. 

Currently SSH is an orphan protocol; there is no IETF WG to work on it and PQUIP will not do any standardizations. So, for now a few collaborators are coding to the living draft spec in https://github.com/csosto-pk/pq-ssh/blob/master/draft-kampanakis-ssh-pq-ke.txt For the record, this spec currently specifies the use of ECDH+Kyber (Kyber is NIST's KEM pick) very similarly to how OpenSSH does it with SNTRU. So, theoretically we could all interop easily by using the same algorithms. 



-----Original Message-----
From: Pqc <[e-mail]> On Behalf Of Alexandre Petrescu
Sent: Wednesday, March 1, 2023 8:11 AM
To: [e-mail]
Subject: RE: [EXTERNAL][Pqc] [EXTERNAL] Mapping the state of PQC and IETF - ssh

CAUTION: This email originated from outside of the organization. Do not click links or open attachments unless you can confirm the sender and know the content is safe.



Le 28/02/2023 à 02:46, Mike Ounsworth a écrit :
> Done.
>
> PR -
> https://github.com/ietf-wg-pquip/state-of-protocols-and-pqc/pull/2
>
> That "No Action Needed" list is shorter than I expected (probably due 
> to my ignorance of the WGs I'm not involved in): ACME, CMC, QUIC, DoH, 
> EST, HTTPS, SCEP, S/MIME
>
> I'm sure I missed a pile of blah-over-tls or blah-over-ssh things.
> Though maybe obvious enough that they'll get PQ when TLS/SSH does?

I was under the impression that the ssh command already runs with a quantum-resistance option, since maybe several months now?  (something like 'ssh -qr' ?  I mean the kind of use of options, but the option name '-qr' I really dont know)

Or am I wrong to assume that ssh runs with quantum resistance somehow?

Alex

>
> --- Mike Ounsworth
>
> -----Original Message----- From: Pqc <[e-mail]> On Behalf 
> Of Mike Ounsworth Sent: Monday, February 27, 2023 6:16 PM To: Sofía 
> Celi <[e-mail]>; [e-mail] Subject: Re: [Pqc] 
> [EXTERNAL] Mapping the state of PQC and IETF
>
> Wicked, thanks for starting this github page!
>
> I started this thread asking for, I guess, the converse of this
> document: IETF (Sec Area) protocols that DON'T need a PQ draft.
>
> For example: SCEP (RFC 8894) does not itself specify any crypto, but 
> embeds CMS (RFC 5652) and PKCS #10 (RFC 2986).
>
> ACME embeds JOSE/JWS (RFC 7515) and PKCS #10 (RFC 2986).
>
> Etc.
>
> It would probably be a service to the community to document those on 
> the PQUIP github page so that people know that "Do Nothing" is the 
> correct action. Basically, every Sec Area protocol probably needs to 
> be on that page under either "Action Needed" or "Action Not Needed".
> Since I suggested it, I guess I just volunteered to put in a PR 
> starting that table. Barring $distraction, I'll try and get something 
> tonight.
>
> --- Mike Ounsworth
>
> -----Original Message----- From: Pqc <[e-mail]> On Behalf 
> Of Sofía Celi Sent: Monday, February 27, 2023 9:47 AM To:
> [e-mail] Subject: [EXTERNAL] [Pqc] Mapping the state of PQC and 
> IETF
>
> WARNING: This email originated outside of Entrust. DO NOT CLICK links 
> or attachments unless you trust the sender and know the content is 
> safe.
>
> ______________________________________________________________________
>
>
Dear, list,
>
> We have started work on mapping the state of PQC (if any draft or RFC 
> exists) in the different IETF protocols/WG and IRTF groups:
> https://urldefense.com/v3/__https://github.com/ietf-wg-pquip/state-of-
> protocols-and-pqc__;!!FJ-Y8qCqXTj2!aJOUSAk6uCUWekoeQOJ2UzMiGwLV2jwgJF9
> cfNHTloERjfqjU5rCmcAqqjMkCcu9ThT9UN5nc3Q4sNLmPx61zSs$
> to keep track of where everything is at. Feel free to contribute by 
> sending a PR. We hope this list is useful to many.
>
> Thank you,
>
> Sofía and Paul
>
> -- Sofía Celi @claucece Cryptographic research and implementation at 
> many places, specially Brave. Chair of hprc at IRTF and anti-fraud at 
> W3C. Reach me out at: [e-mail] Website:
> https://urldefense.com/v3/__https://sofiaceli.com/__;!!FJ-Y8qCqXTj2!aJ
> OUSAk6uCUWekoeQOJ2UzMiGwLV2jwgJF9cfNHTloERjfqjU5rCmcAqqjMkCcu9ThT9UN5n
> c3Q4sNLmg_1qK50$
>
>
3D0B D6E9 4D51 FBC2 CEF7  F004 C835 5EB9 42BF A1D6
>
> -- Pqc mailing list [e-mail]
> https://urldefense.com/v3/__https://www.ietf.org/mailman/listinfo/pqc_
> _;!!FJ-Y8qCqXTj2!aJOUSAk6uCUWekoeQOJ2UzMiGwLV2jwgJF9cfNHTloERjfqjU5rCm
> cAqqjMkCcu9ThT9UN5nc3Q4sNLm2Xw6TiA$
>
>
Any email and files/attachments transmitted with it are confidential and are intended solely for the use of the individual or entity to whom they are addressed. If this message has been sent to you in error, you must not copy, distribute or disclose of the information it contains. Please notify Entrust immediately and delete the message from your system.

--
Pqc mailing list
[e-mail]
https://www.ietf.org/mailman/listinfo/pqc