Re: [saag] [EXTERNAL] [Secdispatch] Clarification on my PQC remarks.

[Mike Ounsworth <[e-mail]>]

Hi Phillip,

Can you clarify some of your comments?


> I do expect the process of transitioning to PQC to take a very long time and not least because we don't even have a key exchange that works for static data yet.

I assume by that you mean a PQ asymmetric primitive that behaves like a Key Transport mechanism in that it will take pre-existing key material and securely transport it to a recipient?


> ... I have an approach that works for the Mesh. It is a hybrid scheme because that is the only way I can achieve the necessary separation of roles

I assume you mean an HPKE-like thing that uses a block cipher in between the KEM and the secret you're trying to transport?




I fundamentally agree with your openness to exploring all options at this point, but I also lean towards standardizing mechanisms that we have now as building blocks for those who want to implement sooner -- which should in no way preclude continuing to search for better mechanisms. Where a draft depends on the outcome of the NIST competition, I like the approach of adopting drafts, getting them "ready", and then pausing them to wait for the final version of whatever NIST standard they depend on. That gets the bulk of the wok done in advance so we can pivot quickly after NIST publications, while also giving early adopters something to implement against. (The counter-argument is that early adoption here could be dangerous (worse than doing nothing?) and the IETF should not give people the rope to hang themselves with, but I will leave that argument for others to make).



Get Outlook for Android<https://aka.ms/AAb9ysg>
________________________________
From: Secdispatch <[e-mail]> on behalf of Phillip Hallam-Baker <[e-mail]>
Sent: Tuesday, July 26, 2022 10:32:17 PM
To: IETF SAAG <[e-mail]>; IETF SecDispatch <[e-mail]>
Subject: [EXTERNAL] [Secdispatch] Clarification on my PQC remarks.

WARNING: This email originated outside of Entrust.
DO NOT CLICK links or attachments unless you trust the sender and know the content is safe.
________________________________
So to clarify my remarks at the mic on the likely arrival time of Quantum Computers. I believe two things to be true:

1) It is highly unlikely that a Quantum Computer capable of doing quantum cryptanalysis of current industry standard algorithms will be publicly deployed in the immediate future

2) There is no time to waste in developing PQC systems.

My concern about overstating the likelihood of a near term threat is that I have seen many past efforts predicated on a very very short timeline (12 months) take much much longer than they needed to (7 years) as a result. Oh there is no time to consider your proposal, this has to be done immediately!

I do expect the process of transitioning to PQC to take a very long time and not least because we don't even have a key exchange that works for static data yet. Unless there is a clever El-Gamal type approach to turn an interactive exchange into a static one. I have an approach that works for the Mesh. It is a hybrid scheme because that is the only way I can achieve the necessary separation of roles which I actually consider to be a much bigger issue than PQC right now.

On the Quantum Computing technology side, it is probably a mistake to take too much notice of the rate of progress in super cooled Josephson junction machines. Those teams will likely continue to add Qbits or extend their coherence times incrementally but at exponentially increasing cost.

Trapped ion machines offer an approach that is fundamentally much easier to scale. They can be made in regular silicon foundries and the problem of building a 10 Qbit machine is really no different from that of building a thousand or a million. Fortunately, there are fundamental problems to be solved before that can happen (if you are going to operate it for longer than a second, it gets much harder). But if they do, the time interval between 'barely functional quantum computer' to 'quantum computer breaking any public key crypto system' is likely to be rather short.

So I agree with Russ and everyone else who says that we have to start now. There is no time to waste. But if we want to move fast, we need to start off by getting a broad base of people up to speed on these new technologies and not be afraid to look at multiple approaches to retrofitting existing protocols.

In some cases, adapting protocols to the PQC algorithms is going to be straightforward but others are likely to require substantial adaptation and in some cases the best approach will be to start from scratch.
Any email and files/attachments transmitted with it are confidential and are intended solely for the use of the individual or entity to whom they are addressed. If this message has been sent to you in error, you must not copy, distribute or disclose of the information it contains. Please notify Entrust immediately and delete the message from your system.