Re: [Pqc] [Ext] Mapping the state of PQC and IETF

On Mon, Feb 27, 2023 at 10:27 AM Alexandre Petrescu <
alexandre.petrescu@gmail.com> wrote:

>
>
> Le 27/02/2023 à 16:58, Paul Hoffman a écrit :
> > On Feb 27, 2023, at 7:46 AM, Sofía Celi <cherenkov@riseup.net>
> > wrote:
> >> We have started work on mapping the state of PQC (if any draft or
> >> RFC exists) in the different IETF protocols/WG and IRTF groups:
> >> https://github.com/ietf-wg-pquip/state-of-protocols-and-pqc to
> >> keep track of where everything is at. Feel free to contribute by
> >> sending a PR. We hope this list is useful to many.
> >
> > Or, if you're not comfortable with opening GitHub pull requests,
> > feel free to open an issue on the tracker or just post something here
> > on the list!
>
> Thanks for the list of drafts and RFC about PQC at IETF - impressive,
> already 19 documents.
>
> I am not a crypto expert, sorry if I say naive things.
>
> One question that comes up in some discussions in other IETF groups is
> related to the need (or no need) to upgrade to quantum resistance some
> IETF methods that generate parts of an IP address.
>
> For example, RFC3972 'CGAs' (crypto generated addresses) uses a lengthy
> algorithm involving SHA-1; this RFC is then further used by LISP RFC,
> among others.
>
> Would there be any risk in LISP using these CGAs, and thus would there
> be a need to migrate to quantum-resistant algorithms?
>
> The same kind of question applies to other RFCs for other protocols such
> as the return routability tests for MIP6, and others, perhaps HIP.
>
> I am also wondering about the use of algorithms such as MD5 or SHAx to
> generate random - probably unique - numbers (e.g. ULA generation method
> in RFC4193).  Would they be at risk in that randomness (risk of
> duplicates), currently, or not.  Would they need to be migrated to
> quantum resistance; would these new algos be better at generating
> uniqueness?
>
> This question of need - is there any need of quantum-resistance in this
> or that particular context - is very important in many places.  Without
> more definite agreements there would be no migration in the immediate.
>
> It might that there is no currently perceived need, but would rather
> need to move to quantum resistance because all others do, if one wants
> to stay interoperable.
>
> It might be that there is no currently perceived need, and one should
> not move to quantum resistance currently because that involves too much
> energy and compute consumption.
>
>

+1

Thanks Alex for nicely summing up our discussions on this issue and looking
forward PQC expert opinion.

Behcet

> Alex
>
> >
> > --Paul Hoffman
> >
>
> --
> Pqc mailing list
> Pqc@ietf.org
> https://www.ietf.org/mailman/listinfo/pqc
>