Re: [saag] Follow-up to IETF 111 discussion on PQC agility

Hi Roman, 

(a) Imo "CURDLE-style" WG is the most suitable. It can go as deep as its participants and their expertise allows it to go. Although in reality it is more likely to focus on a few areas like CURLE ended up doing. 

(b) Some of the work the TLS and LAMPS WGs are already doing. For example how PQ KEMs are used in hybrid key exchange in TLS will resemble how key exchange takes place in SSH. So I would expect the TLS and LAMPS PQ efforts to cross pollinate with this WGs efforts. 

(c) Imo SSH and DNSSEC initially. We ought to get some DNSSEC experts for the latter though. For SSH I think there is interest already. JOSE, XML or other orphan standards can be added in the charter if there is more interest by participants, especially given that there was no documents coming out of CURDLE for those. 

Rgs, 
Panos

-----Original Message-----
From: saag <saag-bounces@ietf.org> On Behalf Of Roman Danyliw
Sent: Wednesday, October 20, 2021 4:26 PM
To: saag@ietf.org
Subject: [EXTERNAL] [saag] Follow-up to IETF 111 discussion on PQC agility

CAUTION: This email originated from outside of the organization. Do not click links or open attachments unless you can confirm the sender and know the content is safe.

Hi!

At the past SAAG meeting at IETF 111, we had a discussion on approaches for ensuring post-quantum cryptography (PQC) agility in IETF work [1].  The mic-line and jabber generated a robust discussion about PQC and generic priorities, but didn't get to discussing specific actions.  Also introduced during that SAAG meeting was a draft "CURDLE-style" (i.e., a scope like the CURDLE WG [2]) charter for PQC agility [3].  This charter defined an approach to fill the gap of adapting or updating IETF protocols, registries, and associated code points, for which no other WG exists, with PQ cryptographic mechanisms.  Left for discussion was which specific work and partners should be considered.

Since the IETF 111, we've had some mailing list discussion [4] on refining a proposed approach via [3] and are beginning to define what work might be a candidate for needing PQC agility but doesn't have a natural, existing WG.  More feedback would be helpful on:

(a) Should we be considering an alternative to this kind of "last resort"/"CURDLE-style" WG?

(b) Per the template field "[Post Quantum work collaborators]" in [3], who should be our partners for PQC guidance?  Current suggestions are US NIST and IRTF CFRG.

(c) Per the template field "[Protocols requiring attention without an active WG]" in [3], which work should be considered?  Current suggestions are secure shell (SSH).  Previous protocols considered during CURDLE were JOSE, DNSSEC, XML Digital Signatures and XML Encryption.

Regards,
Roman and Ben

[1] https://datatracker.ietf.org/meeting/111/materials/slides-111-saag-how-should-the-ietf-approach-post-quantum-security-02
[2] https://datatracker.ietf.org/wg/curdle/about/
[3] https://github.com/rdanyliw/ietf-pq-maintenance/blob/main/pqm-charter.md
[4] https://mailarchive.ietf.org/arch/msg/saag/oHqit0O7N7uhucuDAMwWgRPWqIc/

_______________________________________________
saag mailing list
saag@ietf.org
https://www.ietf.org/mailman/listinfo/saag