Re: [saag] SSH & Ntruprime

[Stephen Farrell <[e-mail]>]

Hiya,

On 22/03/2024 11:32, Loganaden Velvindron wrote:
> I went through SAAG minutes, and I noticed that the crypto panel
> decided that this should not be standardized.

Making such a decision is not within the remit of the
cfrg crypto review panel IMO.

> https://datatracker.ietf.org/doc/draft-josefsson-ntruprime-ssh/
> 
> OpenSSH publicly stated that they will keep offering
> curve25519+sntrup761 even after ml-kem is standardized.
> 
> Several SSH implementations also support this. Is it a good idea that
> de-facto widespread adoption is not at least documented in a RFC ?

I think the potential IPR issues with ML-KEM/Kyber still
being murky, and the fact that an extremely widely used
tool uses this, are both excellent arguments for progressing
Simon's draft.

Not progressing that, esp if by shunting people away via
process minutiae, would be an error.

Cheers,
S.

PS: ISTM this is precisely the kind of thing that is suited
for AD sponsorship - no WG, lots of practical impact and not
much to change, yet giving the community the chance to discuss
(via IETF LC) a real case of whether, and if so when, we want
hybrids with more than ML-KEM.