Subject: [Cfrg] Postquantum cryptography in IETF protocols

From: John Mattsson <[email-masked]>
Date: Mon, 14 Nov 2016 04:13:19 +0000

Hi,

Good that CFRG starts some more detailed discussion on PQC. It makes sense
to support post-quantum key exchange for use cases that need long-term
confidentiality (15 years). For other use cases I think it can wait until
PQC key exchange algorithms has been thoroughly evaluated and
standardized. If implemented now, it should be used in addition to ECDHE,
just like Google has done with their experimental New Hope implementation.

I have noticed a lot of uncertainty in various SDOs on how quantum
computers will affect algorithms and protocols, what needs to be done, and
when things need to be done. I recently wrote the following FAQ for 3GPP.

http://www.3gpp.org/ftp/TSG_SA/WG3_Security/TSGS3_85_Santa_Cruz/Docs/S3-161
847.zip

I suggest that CFRG produces something similar (but more detailed) and
publish it at an informational document. I think a document giving PQC
guidance to IETF WGs and users of IETF standards would be very useful.

Cheers,
John

---

From: "David McGrew (mcgrew)" <[email-masked]>
Date: Mon, 14 Nov 2016 04:31:53 +0000

Hi John,

>just like Google has done with their experimental New Hope implementation.

Thanks for the encouraging words, I think many people agree with you on the redundant ECDH/Lattice thing.   

There was a discussion at IETF 95 CFRG - slides at https://www.ietf.org/proceedings/95/slides/slides-95-cfrg-4.pdf

Postquantum secure signatures are need for software/firmware/data signing; that’s an important use case where hash based signatures seem useful.

Best

David 

>_______________________________________________
>Cfrg mailing list
>[email-masked]
>https://www.irtf.org/mailman/listinfo/cfrg