Subject: [Cfrg] New draft on the transition from classical to post-quantum cryptography

From: "Paul Hoffman" <[email-masked]>
Date: Wed, 03 May 2017 15:27:02 -0700

Greetings again. I have just published a very, very preliminary Internet 
Draft to help people understand when they have to make the transition 
from classical to post-quantum cryptography. The draft information is 
here:

Name:		draft-hoffman-c2pq
Revision:	00
Title:		The Transition from Classical to Post-Quantum Cryptography
Document date:	2017-05-03
Group:		Individual Submission
Pages:		12
URL:        
https://www.ietf.org/internet-drafts/draft-hoffman-c2pq-00.txt
Status:     https://datatracker.ietf.org/doc/draft-hoffman-c2pq-00

This -00 is full of holes, but gives a structure for how to tell people 
about quantum computers that apply to breaking cryptographic keys, how 
to tell when those computers might become feasible, and what they need 
to think about for the transition. It most emphatically does *not* cover 
post-quantum algorithms other than to say "go look here for more info on 
that". That is, this document is about determining when people need to 
make the transition, not the algorithms to which they might transition.

Clearly, the draft needs a lot of input. Not only are there holes, there 
may be flat-out errors in it. That's why there is the strong disclaimer 
at the beginning; I am not a cryptographer, a mathematician, or a 
physicist, but I do work in fields where people are asking "should we 
even be thinking about post-quantum crypto".  Suggestions for text are 
great, suggestions that come with references are even better.

Does this seem like something that CFRG might be interested in adopting 
as an RG document? If so, I can make the next version 
draft-irtf-cfrg...; if not, I can keep this as an individual draft that 
will get published in the IETF stream instead of the IRTF stream.

--Paul Hoffman

---

From: "Tams, Benjamin" <[email-masked]>
Date: Thu, 4 May 2017 10:17:29 +0000

Hi Paul,

thank you for producing the initial draft. I think such a document can be very useful for
the community and individual organizations for being taken into account for properly managing 
risk in view of possible attacks by quantum computers. I briefly read over the document. 

Here are some personal comments on the organization of the document.

If the intention of the final document is to help people understand when they have to make the
transition  from classical to post-quantum cryptography, I would like to propose to set the focus 
more on what an organization should consider for deciding whether or not to go from classical to 
post-quantum cryptography. My very personal vision is to motivate the reader to consider the
following questions.

1. What if useful quantum computers arise in the short term (e.g. 0-10 years), 
middle term (eg. 10-15 years), or long term (e.g. 15-25 years)?

2. What if I use classical cryptography today, that can be broken 
by a quantum computer in the short, middle or long term?

3. When should I switch to post-quantum cryptography for digital signatures, asymmetric
encryption, or symmetric encryption? 

4. Is my application worth for being attacked by someone who can use a quantum
computer? If it is, why? (This question is already addressed in Section 5 of the draft).

Essentially, I think the intention of the document should not be to convince the reader to use
or not to use post-quantum cryptography. It should rather leave it to the reader to decide
whether or not (and if to which extent) he considers it necessary to apply post-quantum 
cryptography in his application. 

Anyway, if an organization's decision is to use post-quantum cryptography (a decision that we
should leave open), then the organization should be able to access a specification suitable for
implementation, timely. While CFRG may already specify documents for
PQ-safe digital signatures, CFRG seems to hesitate to specify something for  PQ-safe public
key encryption. It is (not just) my opinion, that the need for PQ-safe public key encryption
is much higher, though less matured. 

If we leave it open by a CFRG (or similar) document, that the reader's  decision is to use PQ-safe
public key encryption, then we should also provide a corresponding specification - a building block 
that is still missing for IETF drafts  (https://tools.ietf.org/html/draft-whyte-qsh-tls13-04). Also see 
previous posts in this forum
(https://www.ietf.org/mail-archive/web/cfrg/current/msg09087.html).

@CFRG: Still, I am happy if there are people that are willing to specify PQ-safe public key
encryption. Alternatively, I would like to consider to initiate an individual submission for such
a draft.

Kind regards,
Benjamin

-----Ursprüngliche Nachricht-----
Von: Cfrg [mailto:[email-masked]] Im Auftrag von Paul Hoffman
Gesendet: Donnerstag, 4. Mai 2017 00:27
An: [email-masked]
Betreff: [Cfrg] New draft on the transition from classical to post-quantum cryptography

Name:		draft-hoffman-c2pq
Revision:	00

--Paul Hoffman

_______________________________________________
Cfrg mailing list
[email-masked]
https://www.irtf.org/mailman/listinfo/cfrg

---

From: "Paul Hoffman" <[email-masked]>
Date: Sun, 07 May 2017 17:18:51 -0700

On 4 May 2017, at 3:17, Tams, Benjamin wrote:

> risk in view of possible attacks by quantum computers.

Thanks

> I briefly read over the document.
>

That is certainly my intention.

> is much higher, though less matured.

And I completely want to avoid any discussion of such a specification in 
this document; I consider "when you want to move to post-quantum" 
orthogonal to "at the time you move, here are your best options".

--Paul Hoffman

---

From: "Tams, Benjamin" <[email-masked]>
Date: Mon, 8 May 2017 08:52:30 +0000

> orthogonal to "at the time you move, here are your best options".

I agree. Of course this should not be discussed in the document. But, I
took the opportunity to emphasize the need for such a specification in my
post.

Best regards,
Benjamin Tams

---

From: "Salz, Rich" <[email-masked]>
Date: Mon, 8 May 2017 12:46:15 +0000

> And I completely want to avoid any discussion of such a specification in this
> document; I consider "when you want to move to post-quantum"

Well, it's not of course.  What you do when you move depends on what is available at that time and options are likely to improve as Science Marches Forward.

I also think when to move depends on what you're trying to do. The protection you need for online ecommerce buying razor blades is very different from launching missles is very different from long-term archival storage of official documents.

I think both of these things should at least be touched on.

---

From: "Paul Hoffman" <[email-masked]>
Date: Mon, 08 May 2017 06:46:36 -0700

On 8 May 2017, at 5:46, Salz, Rich wrote:

> Well, it's not of course.  What you do when you move depends on what 
> is available at that time and options are likely to improve as Science 
> Marches Forward.

Fair point. There is a subtlety in "when you want to move to 
post-quantum" of "there is a post-quantum solution at the time that 
meets your needs". My unstated assumption is that NIST and others around 
the world will have standardized on some solutions before the readers of 
this document (or a future version of it) feel the need to change. I'll 
reflect that better in the next draft.

> I also think when to move depends on what you're trying to do. The 
> protection you need for online ecommerce buying razor blades is very 
> different from launching missles is very different from long-term 
> archival storage of official documents.
>

Fully agree.

--Paul Hoffman

---

From: "Tams, Benjamin" <[email-masked]>
Date: Mon, 8 May 2017 13:57:07 +0000

> My unstated assumption is that NIST and others around 
> this document (or a future version of it) feel the need to change.

Do we know this? I can pretty well imagine that there may already now
exist the need to protect traffic with PQ-safe solutions that cannot wait
until the NIST standardization process comes with a specification in 
2023 - 2025 according to the timeline suggested in 

http://csrc.nist.gov/groups/ST/post-quantum-crypto/workshops.html 

Regards
Benjamin Tams

---

From: "Blumenthal, Uri - 0553 - MITLL" <[email-masked]>
Date: Mon, 8 May 2017 14:20:52 +0000

On 5/8/17, 9:46 AM, "Cfrg on behalf of Paul Hoffman" <[email-masked] on behalf of [email-masked]> wrote:

    
    meets your needs". 

Technically you both are correct, and the two issues (“when” and “to what”) are orthogonal. In practice however they lose much without one another. 

I understand that we may have a better idea now as to “when” over what “the best options” are likely to be “then” (so it’s easier to talk about “when”, even though both recommendations – not just “to what” but also “when” - may change as time advances).

I see the two as two parts of a single document, or as two closely related drafts, cross-referenced, and released together.

Wouldn’t you agree that for long-term documents (those that need to survive for 15+ - 20+ years from now) the “need to change” is now with a pretty high probability? Wouldn’t that break your assumption?
    
    > I also think when to move depends on what you're trying to do.

Yes. ;-)

For some applications the need appears to be “now”.

---

From: "Paul Hoffman" <[email-masked]>
Date: Mon, 08 May 2017 07:28:26 -0700

On 8 May 2017, at 7:20, Blumenthal, Uri - 0553 - MITLL wrote:

> Wouldn’t you agree that for long-term documents (those that need to 
> survive for 15+ - 20+ years from now) the “need to change” is now 
> with a pretty high probability?

No. That is, I haven't seen evidence that there will be quantum 
computers in 15 to 20 years from now that will be able to break 
classical cryptography using current key sizes. The same is true if you 
said "50 years". Of course, I might have missed something in the early 
research for the -00 draft, so if you have pointers to such 
calculations, that would be great.

I strongly suspect that some organizations feel a strong need to start 
protecting such messages and are very interested in standardizing on 
good pqc algorithms. If those organizations have any pointers as to how 
they are making their judgements, that would greatly help this draft.

--Paul Hoffman

---

From: "Blumenthal, Uri - 0553 - MITLL" <[email-masked]>
Date: Mon, 8 May 2017 14:34:42 +0000

said "50 years". 

First, I’m sure there are documents now that need a “secure life” longer than 20 or even 50 years.

    Of course, I might have missed something in the early 
    research for the -00 draft, so if you have pointers to such 
    calculations, that would be great.

Alas, my crystal ball is out of order right now. But scientific progress tends to be not exactly predictable/calculate-able. E.g., did you expect to talk about “quantum computers breaking crypto” 20 years ago? I didn’t.

---

From: "Dearlove, Christopher (UK)" <[email-masked]>
Date: Tue, 9 May 2017 09:16:52 +0000

The NSA, who probably have the longest timescales, say (https://www.iad.gov/iad/library/ia-guidance/ia-solutions-for-classified/algorithm-guidance/assets/public/upload/CNSA-Suite-and-Quantum-Computing-FAQ.pdf, on page 8):

"Algorithms often require 20 years to be fully deployed on NSS. NSS equipment is often used for 30 years or more. National security information intelligence value is often 30 years (sometimes more) although it may vary depending on classification, sensitivity, and subject."

[NSS = National Security System]

-- 
Christopher Dearlove
Senior Principal Engineer
BAE Systems Applied Intelligence Laboratories
__________________________________________________________________________

T:  +44 3300 467500  |  E: [email-masked]

BAE Systems Applied Intelligence, Chelmsford Technology Park, Great Baddow, Chelmsford, Essex CM2 8HN.
www.baesystems.com/ai
BAE Systems Applied Intelligence Limited
Registered in England & Wales No: 01337451
Registered Office: Surrey Research Park, Guildford, Surrey, GU2 7YP

-----Original Message-----
From: Cfrg [mailto:[email-masked]] On Behalf Of Blumenthal, Uri - 0553 - MITLL
Sent: 08 May 2017 15:35
To: Paul Hoffman
Cc: [email-masked]
Subject: Re: [Cfrg] New draft on the transition from classical to post-quantum cryptography

 
********************************************************************
This email and any attachments are confidential to the intended
recipient and may also be privileged. If you are not the intended
recipient please delete it from your system and notify the sender.
You should not copy it or use it for any purpose nor disclose or
distribute its contents to any other person.
********************************************************************

---

From: Russ Housley <[email-masked]>
Date: Wed, 10 May 2017 14:52:07 -0400

> First, I’m sure there are documents now that need a “secure life” longer than 20 or even 50 years.

Children born this year might need their healthcare records protected from the discovery of a quantum computer before they die.

Russ

---

From: Stephen Farrell <[email-masked]>
Date: Wed, 10 May 2017 20:35:25 +0100

On 10/05/17 19:52, Russ Housley wrote:
> Children born this year might need their healthcare records protected
> from the discovery of a quantum computer before they die.

Genomic data from any of us is liable to remain sensitive for our
grandchildren, in 100 years time. It's sensitivity may even increase
the longer one waits.

S.

---

From: Richard Outerbridge <[email-masked]>
Date: Wed, 10 May 2017 17:52:31 -0400

> On 2017-05-10 (130), at 15:35:25, Stephen Farrell <[email-masked]> wrote:
> 

great-

> grandchildren, in 100 years time. It's sensitivity may even increase

?
__outer

---

From: Hugo Krawczyk <[email-masked]>
Date: Thu, 11 May 2017 00:02:01 -0400

I want to highlight the importance of the post-quantum work regardless of
the post-quantum prospects, namely, independently of the predictions and
feasibility of constructing Shor-grade quantum computers.

People claim that we need to move to quantum-resistant crypto now (or in
the near future) since there is information created now that needs to stay
secret for 30-50 (even 100) years. My strong recommendation for such
applications is to NOT use public key (PK) encryption or PK-based online
key exchange to generate encryption keys for this data. Rather exchange
keys offline and onion-encrypt with several symmetric ciphers and
over-sized keys (twice the security parameter).

This recommendation is *independent* of the prospects of quantum
computation (QC) reaching the point in which it can break PK cryptosystems.
It is rather based on the precarious standing of all our public key
algorithms and their potential vulnerabilities to *classical*
cryptanalysis.

Is the probability of ECC and/or RSA being broken by mathematical
cryptanalysis higher or lower than the probability of these systems being
broken by QC in x years?  I don't know. But I do know that while a powerful
quantum computer will not be built overnight, a devastating mathematical
break (of EC or RSA cryptography) could happen in the middle of the night.
All you need is one bright person dreaming the right idea.

So what I am saying is that we need to thank QC for drawing attention to
the need to diversify our algorithms, to build our protocols with algorithm
agility and negotiation, to invest serious funding in researching new
public key mechanisms, particularly in the area of lattice-based
cryptography (where many other benefits are likely to arise), and to make
us all think about how to *really* ensure long-term secrecy. We should have
done all of this without the threat of powerful quantum computers, but
without it we wouldn't have had the attention and funding we now have to
address these most important problems.

So, thanks QC! You are already making our systems more durably secure! Now,
let's not allow the speculations surrounding the feasibility and timing of
QC distract us from the really important task of diversifying PK
Cryptography.  Keep the attention, focus and funding coming.

Hugo