[saag] PQC in ZRTP (RFC6189) and hybrid KEM

[Johan Pascal <[e-mail]>]

Dear Saag,

on Roman's advice, I post on this list to mention the need for an update to ZRTP in order to support Post-Quantum Crytography. RFC6189 was an individual submission and as far as I know no active WG is maintaining this protocol.

ZRTP is based on (EC)DH and requires a deep rework to support the KEM interface used by the NIST PQ key exchange algorithms. I started working on this topic, my next step would be to submit am I-D updating RFC6189 but I'm far from it so if someone is interested let me know and I can share the preliminary analysis to start a discussion.

Side note: The PQC version of ZRTP should actually use an hybrid key exchange using both (EC)DH and PQ-KEM in parallel. Every protocol using key exchange/encapsulation algorithm and willing to transition toward PQC have to deal with this problem so I think it would be more effective to address it in a specific document that would describe:

- how to implement a KEM from X25519/X448 or others (EC)DH algorithms

- how to combine the output of two or more KEMs to provide an hybrid one that would be seen from the protocol level (like ZRTP for example) as a single KEM.

Some combiners suggestions can be found for example in this publication https://eprint.iacr.org/2018/903.pdf" rel="nofollow">https://eprint.iacr.org/2018/903.pdf

The idea would be to avoid repeating the hybrid KEM description in various documents and focus the discussions on that specific matter in one central point.

Regards,

Johan