Re: [saag] PQC in ZRTP (RFC6189) and hybrid KEM

Hi Johann,

As you say, there are some common design questions with any protocol which
wants to graft PQ onto DH in a hybrid mode. There is already a fair amount
of work in this in TLS (
https://datatracker.ietf.org/doc/draft-ietf-tls-hybrid-design/), though it
looks less like making ECDH act like a KEM and more often making the KEMs
act like ECDH. I'm honestly not sure how much new work there is to do here;
over in TLS we're mostly waiting for NIST. I do think it would be helpful
to have CFRG or the like specific a PQ algorithm but I'm not sure a generic
algorithm describing hybrid will help that much, as opposed to having that
last mile be protocol specific

Process-wise, the IETF is not maintaining ZRTP, so you would probably need
to do an individual submission or send it to the ISE if you want to update
it.

-Ekr

On Tue, Nov 16, 2021 at 1:32 PM Johan Pascal <johan.pascal@linphone.org>
wrote:

> Dear Saag,
>
> on Roman's advice, I post on this list to mention the need for an update
> to ZRTP in order to support Post-Quantum Crytography. RFC6189 was an
> individual submission and as far as I know no active WG is maintaining this
> protocol.
>
> ZRTP is based on (EC)DH and requires a deep rework to support the KEM
> interface used by the NIST PQ key exchange algorithms. I started working on
> this topic, my next step would be to submit am I-D updating RFC6189 but I'm
> far from it so if someone is interested let me know and I can share the
> preliminary analysis to start a discussion.
>
>
> Side note: The PQC version of ZRTP should actually use an hybrid key
> exchange using both (EC)DH and PQ-KEM in parallel. Every protocol using key
> exchange/encapsulation algorithm and willing to transition toward PQC have
> to deal with this problem so I think it would be more effective to address
> it in a specific document that would describe:
>
> - how to implement a KEM from X25519/X448 or others (EC)DH algorithms
>
> - how to combine the output of two or more KEMs to provide an hybrid one
> that would be seen from the protocol level (like ZRTP for example) as a
> single KEM.
>
> Some combiners suggestions can be found for example in this publication
> https://eprint.iacr.org/2018/903.pdf
>
> The idea would be to avoid repeating the hybrid KEM description in various
> documents and focus the discussions on that specific matter in one central
> point.
>
> Regards,
>
> Johan
> _______________________________________________
> saag mailing list
> saag@ietf.org
> https://www.ietf.org/mailman/listinfo/saag
>