Re: [Pqc] [WG last call] IETF WG state changed for draft-ietf-pquip-pqt-hybrid-terminology

["D. J. Bernstein" <[e-mail]>]

Sorry for not having had a chance to look at this draft earlier.

We _hope_ that cryptography is secure. However, beyond some corner
cases, we don't _know_ that it's secure. In many cases, it turns out
_not_ to be secure.

For example, NSA's 1993 "Secure Hash Algorithm" (SHA, later renamed
SHA-0) is not actually secure. Labeling it as "secure" was always
overstating the available knowledge, communicating something
unjustified---and, as we subsequently learned, false---to readers.

It's fine to _ask_ whether cryptography is secure. _Declaring_ that it's
secure is unwarranted hype.

I am also opposed to any attempt to redefine "cryptography" to include
only secure cryptography. This isn't just encouraging hype: it's also

   * stomping on an established name to mean something different,
   * creating unnecessary difficulties for people who want to talk about
     the original concept, and
   * hiding an important qualifier that's often not satisfied and that
     should be made explicit.

To reiterate an earlier [e-mail] discussion: MD5 is still
cryptography. Papers breaking MD5 still count as cryptanalysis. The
Caesar cipher is still a cipher and appears in cryptography textbooks.

I coined the phrase "post-quantum cryptography" in 2003. An important
feature of the phrase is that, just like "cryptography", it is _not_
saying that the cryptography is secure. One can and should _ask_ whether
post-quantum cryptography is secure, i.e., whether the cryptography can
be broken by an attacker with a quantum computer; but _declaring_ that
it's secure is again unwarranted hype.

As an example (again repeated from an earlier discussion) of why it's
important to not bake security into the terminology, imagine the
statement

   In this section, we briefly give an overview of the main families for
   which post-quantum primitives have been proposed ... One such
   proposal is based on evaluating isogenies on supersingular elliptic
   curves

from https://nvlpubs.nist.gov/nistpubs/ir/2016/NIST.IR.8105.pdf being
instead written using the "quantum-resistant" terminology---

   In this section, we briefly give an overview of the main families for
   which quantum-resistant primitives have been proposed ... One such
   proposal is based on evaluating isogenies on supersingular elliptic
   curves

---and then imagine how we would describe the public break of SIKE:

   * Attempt 1: "We told you it's quantum-resistant, and now we're
     telling you it's broken. See how much better informed we are now?"

   * Attempt 2: "Quantum-resistant is actually defined to mean not known
     to be broken, so what we said was correct. Misleading you was an
     accident, really."

   * Attempt 3: "Okay, yes, we were hyping the security to manipulate
     you into taking action, but we didn't actually expect you to
     believe what we were saying."

See my email dated 15 Sep 2023 20:17:27 -0000 for further discussion of
how this deceptive terminology can create real security failures.

Obviously I am also opposed to stomping on the established name
"post-quantum cryptography" to mean quantum-resistant.

I finally had a moment to look at draft-ietf-pquip-pqt-hybrid-terminology-02
and was surprised to read its definition of "post-quantum algorithm":

    An asymmetric cryptographic algorithm that is believed to be secure
    against attacks using quantum computers as well as classical
    computers.  Post-quantum algorithms can also be called
    quantum-resistant or quantum-safe algorithms.

This is conflating different concepts.

"Quantum-resistant" and "quantum-safe" both communicate security. The
words were chosen to communicate this in the first place. A definition
saying "believed to be secure" is understating the intent and effect of
the words.

"Post-quantum" is a neutral timeline phrase that does _not_ communicate
security. Saying "believed to be secure" is overstating the intent and
effect of the words.

I would define "post-quantum cryptography" as "cryptography under the
assumption that the attacker has a quantum computer", and "pre-quantum
cryptography" as "cryptography under the assumption that the attacker
does not have a quantum computer".

I would add a cautionary note saying "In exactly the same way that
cryptography is not necessarily secure, post-quantum cryptography is
not necessarily secure." I would also add a note advising against usage
of the phrases "quantum-resistant cryptography" and "quantum-safe
cryptography".

---D. J. Bernstein