Re: [saag] PQC in ZRTP (RFC6189) and hybrid KEM

It would be useful to get review from AVTCORE, if only to (try to) ensure the thinking about post-quantum crypto for SRTP aligns with ZRTP, to the extent possible.

Colin

> On 22 Nov 2021, at 17:28, Johan Pascal <johan.pascal@linphone.org> wrote:
> 
> Hi,
> 
> thanks for your suggestions. I know the work on hybrid design is already done in TLS and others . While looking for some documentation on that specific problem I found several protocols addressing it, each of them with specific details related to the protocol and that is mainly what led me to think that a document dedicated to hybrid scheme might make sense: it would save the next person trying to achieve exactly what I'm trying to do for ZRTP the work of reading the different specifications, parting what is protocol related and what is not. But the hybrid mechanism can be described in the PQC-ZRTP I-D itself.
> 
> Colin, as the problem of updating ZRTP to a PQ-KEM scheme is mostly security related it made more sense to me to post it on Saag. The perfect list to discuss it would be the potential "PQC Agility" WG if it is charted at some point (https://mailarchive.ietf.org/arch/msg/saag/5uV72m80X9PTGFWFyDY5VrNyK-c/ <https://mailarchive.ietf.org/arch/msg/saag/5uV72m80X9PTGFWFyDY5VrNyK-c/>). Is there any update on this?
> 
> Regards,
> 
> Johan
> 
> On 18/11/2021 23:43, Colin Perkins wrote:
>> Hi Johan,
>> 
>> ZRTP was never adopted as a working group item, but the draft was presented several times in the AVT working group. You might get useful feedback from AVTCORE.
>> 
>> Colin
>> 
>> 
>> 
>>> On 16 Nov 2021, at 21:51, Eric Rescorla <ekr@rtfm.com <mailto:ekr@rtfm.com>> wrote:
>>> 
>>> Hi Johann,
>>> 
>>> As you say, there are some common design questions with any protocol which wants to graft PQ onto DH in a hybrid mode. There is already a fair amount of work in this in TLS (https://datatracker.ietf.org/doc/draft-ietf-tls-hybrid-design/ <https://datatracker.ietf.org/doc/draft-ietf-tls-hybrid-design/>), though it looks less like making ECDH act like a KEM and more often making the KEMs act like ECDH. I'm honestly not sure how much new work there is to do here; over in TLS we're mostly waiting for NIST. I do think it would be helpful to have CFRG or the like specific a PQ algorithm but I'm not sure a generic algorithm describing hybrid will help that much, as opposed to having that last mile be protocol specific
>>> 
>>> Process-wise, the IETF is not maintaining ZRTP, so you would probably need to do an individual submission or send it to the ISE if you want to update it.
>>> 
>>> -Ekr
>>> 
>>> 
>>> 
>>> 
>>> On Tue, Nov 16, 2021 at 1:32 PM Johan Pascal <johan.pascal@linphone.org <mailto:johan.pascal@linphone.org>> wrote:
>>> Dear Saag,
>>> 
>>> on Roman's advice, I post on this list to mention the                           need for an update to ZRTP in order to support Post-Quantum Crytography. RFC6189 was an individual submission and as far as I know no active WG is maintaining this protocol.
>>> 
>>> ZRTP is based on (EC)DH and requires a deep rework to                           support the KEM interface used by the NIST PQ key exchange algorithms. I started working on this topic, my next step would be to submit am I-D updating RFC6189 but I'm far from it so if someone is interested let me know and I can share the preliminary analysis to start a discussion.
>>> 
>>> 
>>> 
>>> Side note: The PQC version of ZRTP should actually use an hybrid key exchange using both (EC)DH and PQ-KEM in parallel. Every protocol using key exchange/encapsulation algorithm and willing to transition toward PQC have to deal with this problem so I think it would be more effective to address it in a specific document that would describe:
>>> 
>>> - how to implement a KEM from X25519/X448 or others (EC)DH algorithms
>>> 
>>> - how to combine the output of two or more KEMs to provide an hybrid one that would be seen from the protocol level (like ZRTP for example) as a single KEM.
>>> 
>>> Some combiners suggestions can be found for example in this publication https://eprint.iacr.org/2018/903.pdf <https://eprint.iacr.org/2018/903.pdf>
>>> The idea would be to avoid repeating the hybrid KEM description in various documents and focus the discussions on that specific matter in one central point.
>>> 
>>> Regards,
>>> 
>>> Johan
>>> 
>>> _______________________________________________
>>> saag mailing list
>>> saag@ietf.org <mailto:saag@ietf.org>
>>> https://www.ietf.org/mailman/listinfo/saag <https://www.ietf.org/mailman/listinfo/saag>
>>> _______________________________________________
>>> saag mailing list
>>> saag@ietf.org <mailto:saag@ietf.org>
>>> https://www.ietf.org/mailman/listinfo/saag <https://www.ietf.org/mailman/listinfo/saag>