[lamps] Re: P-384 in draft-ietf-lamps-pq-composite-kem et al.

["D. J. Bernstein" <[e-mail]>]

I wrote:
> [e-mail] writes:
> > As the CNSA 2.0 profiles should make clear, we are looking for
> > products that support /standalone/ ML-DSA-87 and /standalone/
> > ML-KEM-1024.
> To clarify, does "looking for" non-hybrids mean that NSA won't authorize
> purchases of hybrids? Is there an official statement saying this?

Haven't seen an answer to this.

I posted two quotes from official NSA statements indicating that NSA
recognizes the security value of hybrids and will obey an IETF protocol
standard requiring hybrids. I'm now aware of a third quote fitting this,
from just six months ago. NSA's official position thus seems contrary to
various suggestions that we've been seeing regarding NSA's position.

For ease of reference, here are all three quotes. First,

    https://web.archive.org/web/20220524232250/https://www.nsa.gov/Portals/75/documents/resources/everyone/csfc/threat-prevention.pdf

asks for two independent encryption layers "to mitigate the ability of
an adversary to exploit a single cryptographic implementation". Second,

    https://web.archive.org/web/20240927153634/https://media.defense.gov/2022/Sep/07/2003071834/-1/-1/0/CSA_CNSA_2.0_ALGORITHMS_.PDF

says "hybrid solutions may be allowed or required due to protocol
standards". Third,

    https://web.archive.org/web/20250326233545/https://media.defense.gov/2022/Sep/07/2003071836/-1/-1/0/CSA_CNSA_2.0_ALGORITHMS_.PDF

says "product availability and interoperability requirements may lead to
adopting hybrid solutions". All of these are PDFs with the NSA logo on
top, downloaded by archive.org straight from the NSA web site. The third
states a date of December 2024.

---D. J. Bernstein