[saag] Re: post quantum guidance draft

[John Mattsson <[e-mail]>]

Being sceptic of the quantum computers is perfectly reasonable, but it raises the question: what assumptions lead to the recommendation in [3]?


A common position is that there is a meaningful chance of a CRQC being built within the next 15 years. If that assumption is true, then we urgently need to migrate signatures in long-lived devices. Recommending inaction in that scenario is like having your house on fire, arguing about whether to use a powder or foam extinguisher, and ultimately deciding to recommend doing nothing.


If, on the other hand, the assumption is that a CRQC will never be built—or not within the next 50 years—then it does not make sense to recommend moving to PQ/T KEM hybrids as soon as possible for use cases that do not require 50+ years of confidentiality.


Also note that the likelihood of someone building a CRQC is not independent of our migration choices. Migrating everything now significantly reduces the incentive for any government to invest in building a CRQC in the first place.


Cheers,
John Preuß Mattsson


On 2025-12-11, 00:59, "Stephen Farrell" <[e-mail]> wrote:



Hiya,


For those still following along with this discussion...


For a project [1] we're part of, (where I'm the resident PQ
skeptic:-), I had to do a bit of a survey of ongoing IETF PQ
work and produced [2] which has just been put up on the web
page for the project following some local bureaucracy.


I'm not claiming [2] is a winning argument for [3] but making
it totally re-enforced my opinion that guidance along the lines
suggested in [3] is needed, for two high-level reasons: there's
an avalanche of PQ things happening (section 2 of [2]) and the
related points of disagreement (section 3 of [2]) are such that
we're just not going to reach consensus on the details of the
sensible subset of things to recommend, for now at least.


Cheers,
S.


PS: I don't think we need to debate the content of [2] here,
but I'd be happy to get corrections/comments off-list.


[1] https://pqcsa.eu/ <b7995ab0-5c9f-4507-9c24-d71e39367035>
[2] https://pqcsa.eu/deliverables/pq-protocols.pdf <39e61fb4-6ed3-4585-b0cb-c2cb382e6421>
[3] https://datatracker.ietf.org/doc/draft-farrell-tls-pqg/ <7b4e46d0-4ff4-4138-b106-3d47581a8a22>