Subject: [lamps] Work done elsewhere to start defining OIDs for postquantum algorithms

From: "Scott Fluhrer (sfluhrer)" <[email-masked]>
Date: Thu, 28 Jan 2021 20:04:53 +0000

During the interim working group meeting, it was mentioned that we might want to start assigning OIDs to various postquantum algorithms.

I came across some people already started working on this (I saw this on an X9 list, however looking at it closer, it might not be the X9 doing it); it might make sense to coordinate with them.  Note that they are not working with composite or hybrid algorithms; they are just working with the postquantum algorithms in isolation.

Here is the full text that I received:

I would like to draw everybody's attention to a piece of work focused on key identification and key serialization for post quantum algorithms. This work was started by a small group of industrial partners who are already deploying quantum safe algorithms in an attempt to parallelize efforts around the standardization of quantum safe cryptographic algorithms, at the same time as the standardization required to manage the use of these algorithms. This work is taking place in a completely open format under the following links, and we welcome any participation on this topic:

https://groups.google.com/g/rfc-quantum-safe-key-serialization-and-identification---review

https://docs.google.com/document/d/19XfdzkVdHS69rqin-XV72Cn2FjrpEbiyERg7F1lKIVs/edit?usp=sharing

This goal of this effort is to create an open and public set of initial specifications and formats, that allow a more controlled evolution of quantum safe algorithms. It is hoped that this can provide the technical basis for adoption of formats in other standards that need to evolve to become quantum safe. The scope of the document is initially confined to algorithm identification and key serialization formats. We do not aim to compete with any standards activities, rather preemptively bootstrap a set of guidelines to simplify the adoption and interoperability post quantum algorithms.  Three of the finalist NIST algorithms have been completed (DILITHIUM, FALCON, NTRU), the remaining algorithms together with the alternative list are under development.

Background
New quantum safe key exchange and digital signature algorithms are being developed that are secure against future quantum adversaries. The US National Institute of Science and Technology (NIST) is currently running a multi year process to evaluate potential candidates and select a small set of algorithms to standardize. This process started in 2016 and is expected to finish in 2023. The NIST process thus far did not include any mechanisms to standardize algorithm identifiers and key serialization formats. Parallel to the NIST standardization process, many of the proposed algorithms are being implemented. This is in part for testing and evaluation and in part as pre-standard hybrid solutions. Implementations necessarily need to evolve as the algorithms themselves evolve through the standards process.

Early implementations and pre-standardization roll-outs have also shown that many platforms and protocols are constrained in the size of keys that they are able to handle without significant modification. Post quantum keys are generally larger, in some cases much larger, than current RSA or ECC keys where the concept of compressing parameter sets to reduce key size is already commonly used. This is driven by the need in many application domains to save every byte possible and trade-off key size against the overhead of key regeneration. Applying lessons learnt from the previous incremental standardization of compressed parameter sets, there is a clear benefit to defining this upfront.

The early definition of key identification and key serialization for post quantum algorithms should avoid :
*         Difficulty in managing algorithm versions and the compatibility of associated keys
*         Incompatibility between key compression formats
*         Difficulty in interoperability testing
*         Difficulty in evaluating the impact of integrating algorithms with higher level standards
*         Delays follow on activities for algorithm integration and adoption

By addressing these problems now rather than after waiting for the NIST standards process to complete, it should reduce the time it will take for industry to adopt a new generation of quantum safe cryptography.

kind regards

Mike Osborne

====================================================
Michael Osborne
Manager Privacy and Security
Global Lead IBM Q Encryption
Zurich Research Laboratory,
Saeumerstrasse 4, CH 8803, Rueschlikon / Switzerland
Phone/FAX (41) ( 44 ) 724 8458 / (41) ( 44 ) 724 8953
Extern: [email-masked]<mailto:[email-masked]>