Re: [saag] PQC in ZRTP (RFC6189) and hybrid KEM

Hi Johan,

ZRTP was never adopted as a working group item, but the draft was presented several times in the AVT working group. You might get useful feedback from AVTCORE.

Colin

> On 16 Nov 2021, at 21:51, Eric Rescorla <ekr@rtfm.com> wrote:
> 
> Hi Johann,
> 
> As you say, there are some common design questions with any protocol which wants to graft PQ onto DH in a hybrid mode. There is already a fair amount of work in this in TLS (https://datatracker.ietf.org/doc/draft-ietf-tls-hybrid-design/ <https://datatracker.ietf.org/doc/draft-ietf-tls-hybrid-design/>), though it looks less like making ECDH act like a KEM and more often making the KEMs act like ECDH. I'm honestly not sure how much new work there is to do here; over in TLS we're mostly waiting for NIST. I do think it would be helpful to have CFRG or the like specific a PQ algorithm but I'm not sure a generic algorithm describing hybrid will help that much, as opposed to having that last mile be protocol specific
> 
> Process-wise, the IETF is not maintaining ZRTP, so you would probably need to do an individual submission or send it to the ISE if you want to update it.
> 
> -Ekr
> 
> 
> 
> 
> On Tue, Nov 16, 2021 at 1:32 PM Johan Pascal <johan.pascal@linphone.org <mailto:johan.pascal@linphone.org>> wrote:
> Dear Saag,
> 
> on Roman's advice, I post on this list to mention the need for an update to ZRTP in order to support Post-Quantum Crytography. RFC6189 was an individual submission and as far as I know no active WG is maintaining this protocol.
> 
> ZRTP is based on (EC)DH and requires a deep rework to support the KEM interface used by the NIST PQ key exchange algorithms. I started working on this topic, my next step would be to submit am I-D updating RFC6189 but I'm far from it so if someone is interested let me know and I can share the preliminary analysis to start a discussion.
> 
> 
> 
> Side note: The PQC version of ZRTP should actually use an hybrid key exchange using both (EC)DH and PQ-KEM in parallel. Every protocol using key exchange/encapsulation algorithm and willing to transition toward PQC have to deal with this problem so I think it would be more effective to address it in a specific document that would describe:
> 
> - how to implement a KEM from X25519/X448 or others (EC)DH algorithms
> 
> - how to combine the output of two or more KEMs to provide an hybrid one that would be seen from the protocol level (like ZRTP for example) as a single KEM.
> 
> Some combiners suggestions can be found for example in this publication https://eprint.iacr.org/2018/903.pdf <https://eprint.iacr.org/2018/903.pdf>
> The idea would be to avoid repeating the hybrid KEM description in various documents and focus the discussions on that specific matter in one central point.
> 
> Regards,
> 
> Johan
> 
> _______________________________________________
> saag mailing list
> saag@ietf.org <mailto:saag@ietf.org>
> https://www.ietf.org/mailman/listinfo/saag <https://www.ietf.org/mailman/listinfo/saag>
> _______________________________________________
> saag mailing list
> saag@ietf.org
> https://www.ietf.org/mailman/listinfo/saag