Re: [saag] PQC in ZRTP (RFC6189) and hybrid KEM

[Eric Rescorla <[e-mail]>]

On Mon, Nov 22, 2021 at 9:28 AM Johan Pascal <[e-mail]>
wrote:

> Hi,
>
> thanks for your suggestions. I know the work on hybrid design is already
> done in TLS and others . While looking for some documentation on that
> specific problem I found several protocols addressing it, each of them with
> specific details related to the protocol and that is mainly what led me to
> think that a document dedicated to hybrid scheme might make sense: it would
> save the next person trying to achieve exactly what I'm trying to do for
> ZRTP the work of reading the different specifications, parting what is
> protocol related and what is not. But the hybrid mechanism can be described
> in the PQC-ZRTP I-D itself.
>
> Colin, as the problem of updating ZRTP to a PQ-KEM scheme is mostly
> security related it made more sense to me to post it on Saag. The perfect
> list to discuss it would be the potential "PQC Agility" WG if it is charted
> at some point (
> https://mailarchive.ietf.org/arch/msg/saag/5uV72m80X9PTGFWFyDY5VrNyK-c/).
> Is there any update on this?
>
Well, discuss it, perhaps, but given that ZRTP is not an IETF protocol, we
generally would not publish this document out of that group.

-Ekr

Regards,
>
> Johan
> On 18/11/2021 23:43, Colin Perkins wrote:
>
> Hi Johan,
>
> ZRTP was never adopted as a working group item, but the draft was
> presented several times in the AVT working group. You might get useful
> feedback from AVTCORE.
>
> Colin
>
>
>
> On 16 Nov 2021, at 21:51, Eric Rescorla <[e-mail]> wrote:
>
> Hi Johann,
>
> As you say, there are some common design questions with any protocol which
> wants to graft PQ onto DH in a hybrid mode. There is already a fair amount
> of work in this in TLS (
> https://datatracker.ietf.org/doc/draft-ietf-tls-hybrid-design/), though
> it looks less like making ECDH act like a KEM and more often making the
> KEMs act like ECDH. I'm honestly not sure how much new work there is to do
> here; over in TLS we're mostly waiting for NIST. I do think it would be
> helpful to have CFRG or the like specific a PQ algorithm but I'm not sure a
> generic algorithm describing hybrid will help that much, as opposed to
> having that last mile be protocol specific
>
> Process-wise, the IETF is not maintaining ZRTP, so you would probably need
> to do an individual submission or send it to the ISE if you want to update
> it.
>
> -Ekr
>
>
>
>
> On Tue, Nov 16, 2021 at 1:32 PM Johan Pascal <[e-mail]>
> wrote:
>
>> Dear Saag,
>>
>> on Roman's advice, I post on this list to mention the need for an update
>> to ZRTP in order to support Post-Quantum Crytography. RFC6189 was an
>> individual submission and as far as I know no active WG is maintaining this
>> protocol.
>>
>> ZRTP is based on (EC)DH and requires a deep rework to support the KEM
>> interface used by the NIST PQ key exchange algorithms. I started working on
>> this topic, my next step would be to submit am I-D updating RFC6189 but I'm
>> far from it so if someone is interested let me know and I can share the
>> preliminary analysis to start a discussion.
>>
>>
>> Side note: The PQC version of ZRTP should actually use an hybrid key
>> exchange using both (EC)DH and PQ-KEM in parallel. Every protocol using key
>> exchange/encapsulation algorithm and willing to transition toward PQC have
>> to deal with this problem so I think it would be more effective to address
>> it in a specific document that would describe:
>>
>> - how to implement a KEM from X25519/X448 or others (EC)DH algorithms
>>
>> - how to combine the output of two or more KEMs to provide an hybrid one
>> that would be seen from the protocol level (like ZRTP for example) as a
>> single KEM.
>>
>> Some combiners suggestions can be found for example in this publication
>> https://eprint.iacr.org/2018/903.pdf
>>
>> The idea would be to avoid repeating the hybrid KEM description in
>> various documents and focus the discussions on that specific matter in one
>> central point.
>>
>> Regards,
>>
>> Johan
>> _______________________________________________
>> saag mailing list
>> [e-mail]
>> https://www.ietf.org/mailman/listinfo/saag
>>
> _______________________________________________
> saag mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/saag
>
>
>