[lamps] Re: P-384 in draft-ietf-lamps-pq-composite-kem et al.

["D. J. Bernstein" <[e-mail]>]

[e-mail] writes:
> Obviously, there are folks who view composite as a viable and perhaps
> necessary transition strategy.

Please note that the main argument for hybrids is security. For example,
the large-scale deployment of hybrid SIKE+ECC (CECPQ2) would have been a
security disaster if the ECC part had been removed.

> As the CNSA 2.0 profiles should make clear, we are looking for
> products that support /standalone/ ML-DSA-87 and /standalone/
> ML-KEM-1024.

To clarify, does "looking for" non-hybrids mean that NSA won't authorize
purchases of hybrids? Is there an official statement saying this?

I've seen a few individual employees making statements that sound like
this, but that's not the same as a official statement. Meanwhile I found

    https://web.archive.org/web/20220524232250/https://www.nsa.gov/Portals/75/documents/resources/everyone/csfc/threat-prevention.pdf

asking for two independent encryption layers "to mitigate the ability of
an adversary to exploit a single cryptographic implementation", and

    https://web.archive.org/web/20240927153634/https://media.defense.gov/2022/Sep/07/2003071834/-1/-1/0/CSA_CNSA_2.0_ALGORITHMS_.PDF

saying "hybrid solutions may be allowed or required due to protocol
standards"; i.e., the official statements indicate that NSA recognizes
the security value of hybrids and will obey an IETF protocol standard
requiring hybrids. The latter statement seems to have disappeared from
the current page, but that isn't the same as renouncing it---things can
disappear for pure reorganization reasons.

---D. J. Bernstein