Subject: [Cfrg] Adoption call for draft-hoffman-c2pq-02

From: Alexey Melnikov <[email-masked]>
Date: Sat, 10 Feb 2018 14:30:26 +0000

Dear CFRG participants,
Based on interest in this topic/document during IETF 100 in Singapore
(and based on earlier discussions), CFRG Chairs are asking for any
objections to adopting "The Transition from Classical to Post-Quantum
Cryptography" (draft-hoffman-c2pq-02) as a CFRG document.

Please send your comments by February 24th.

Thank you,
Kenny and Alexey

---

From: Stephen Farrell <[email-masked]>
Date: Sat, 10 Feb 2018 15:46:09 +0000

> Please send your comments by February 24th.

I'm not sure if this is worthwhile, but it might be. The
probability that it ends up with something that's not
worth publishing as an RFC seems fairly high to me.

So long as adoption doesn't mean a commitment to eventual
publication of an RFC on this topic, then I don't object.
If the chairs consider adoption is such a commitment then
I would be against that.

Cheers,
S.

> 
> Thank you,
> Kenny and Alexey
> 
> _______________________________________________
> Cfrg mailing list
> [email-masked]
> https://www.irtf.org/mailman/listinfo/cfrg
> 

-- 
PGP key change time for me.
New-ID 7B172BEA; old-ID 805F8DA2 expires Jan 24 2018.
NewWithOld sigs in keyservers.
Sorry if that mucks something up;-)

---

From: Alexey Melnikov <[email-masked]>
Date: Sat, 10 Feb 2018 16:43:14 +0000

Hi Stephen,

> If the chairs consider adoption is such a commitment then

Adoption doesn't mean commitment to publish. If after doing the work
there is no consensus that the document needs publishing, it will not be
published.

Best Regards,
Alexey

---

From: Rene Struik <[email-masked]>
Date: Sat, 10 Feb 2018 12:24:15 -0500

Dear colleagues:

I believe this draft has no merit and should not be adopted.

There is already an IETF document that caters to the need for algorithm
agility: see RFC 7696 [1]. There is no need for a document that singles
out specific subcategories of technical advances that may necessitate
reconsideration of the security technology used.

The suggested "methodology" in Section 6.1 is bound to be highly
susceptible to misleading claims and "crystal ball" gazing of dubious
technical stature. As such, this does not belong in IRTF/CFRG.

Once there is something of technical nature to report, it is easy to
convert this to an IRTF/CFRG draft and circulate this then. Now, it is
just fashionable "me too" output.

Best regards, Rene

[1] RFC 7696 - Guidelines for Cryptographic Algorithm Agility and
Selecting Mandatory-to-Implement Algorithms (November 2015)

-- 
email: [email-masked] | Skype: rstruik
cell: +1 (647) 867-5658 | US: +1 (415) 690-7363

---

From: "Paul Hoffman" <[email-masked]>
Date: Sat, 10 Feb 2018 09:57:42 -0800

> reconsideration of the security technology used.

RFC 7696 does not discuss the cases where the new mandatory-to-implement 
algorithm has a much higher cost than the one it is replacing. If the 
post-quantum algorithms being chosen have similar work factors to the 
ones they are replacing, this entire document is indeed moot. However, 
it seems likely that the chosen post-quantum algorithms will have much 
larger key sizes, signature sizes, or both and (other than AES256) will 
also be significantly slower.

> technical stature.

Can you say why you feel that technical tests that are led by "trusted 
representatives from the cryptographic community" that is "using 
verifiable means to pick the keys to recover" would be "highly 
susceptible to misleading claims"? There is no evidence that previous 
technical tests for things like breaking short RSA keys or demonstrating 
hash collisions have been susceptible to such claims.

> convert this to an IRTF/CFRG draft and circulate this then.

But that's one of the main points of the document: there are various 
competing statements from the cryptographic community about whether or 
not there is something significant to report today with respect to 
building applicable quantum computers. We know that there are likely to 
be solid post-quantum algorithms which have the benefit of defeating 
applicable quantum computers with higher resource costs; it behooves us 
to determine when that benefit is worth that cost.

--Paul Hoffman

---

From: Stephen Farrell <[email-masked]>
Date: Sat, 10 Feb 2018 18:25:16 +0000

> there is no consensus that the document needs publishing, it will not be

Thanks. With that clarification, I've no problem this
being discussed/worked-on.

S.

---

From: Stephane Bortzmeyer <[email-masked]>
Date: Sun, 11 Feb 2018 17:04:54 +0100

On Sat, Feb 10, 2018 at 03:46:09PM +0000,
 Stephen Farrell <[email-masked]> wrote 
 a message of 193 lines which said:

> The probability that it ends up with something that's not worth
> publishing as an RFC seems fairly high to me.

Why? Could you explain?

---

From: Stephane Bortzmeyer <[email-masked]>
Date: Sun, 11 Feb 2018 17:04:04 +0100

On Sat, Feb 10, 2018 at 02:30:26PM +0000,
 Alexey Melnikov <[email-masked]> wrote 
 a message of 11 lines which said:

> CFRG Chairs are asking for any objections to adopting "The
> Transition from Classical to Post-Quantum Cryptography"
> (draft-hoffman-c2pq-02) as a CFRG document.

I've read the document but I'm not a cryptograpĥer (and not a quantum
physicist either). Just a concerned engineer using cryptography daily.

I think it is a excellent idea to have a RFC published on this
question, and this document seems to me a very good basis.

I do not hope it will give me a simple and final answer, since 1) we
don't have all the facts (we don't know if the NSA found a quantum
computer in the alien ship they are studying in area 51) 2) a lot
depend on quite fundamental research, whose progress is hard to
predict (there is no Moore's law for quantum computers). But I would
be interested in a serious document to use as a reference.

I expect that 2018 will see a lot of hype around post-quantum
cryptography and IETF people will need data on that. I already heard a
high-level CxO talking about chinese QKD progress, and pretending it
allows them to break RSA :-(

I'm ready to read and review.

---

From: Stephen Farrell <[email-masked]>
Date: Sun, 11 Feb 2018 18:42:37 +0000

>> publishing as an RFC seems fairly high to me.

Sure. I think there's a real chance that in the end
this can't really offer any more than an introduction
to schor etc. and that any other content ends up as
too speculative to garner consensus. Either that, or
if there are significant public developments in the
field (and I've no idea of probabilities there), then
any RFC will be OBE so fast it'd not be useful.

I'd be happy to be wrong on the above FWIW.

S.

---

From: "Blumenthal, Uri - 0553 - MITLL" <[email-masked]>
Date: Sun, 11 Feb 2018 20:30:37 +0000

I support adoption of this draft.

Regards,
Uri

Sent from my iPhone

> On Feb 11, 2018, at 13:43, Stephen Farrell <[email-masked]> wrote:
> 
> 
> 
> <0x7B172BEA.asc>