Subject: [Cfrg] NIST Report on 1st Round of PQ Algorithms

From: Russ Housley <[email-masked]>
Date: Thu, 31 Jan 2019 10:51:24 -0500

NIST just posted NISTIR 8240, the Status Report on the First Round of the NIST Post-Quantum Cryptography Standardization Process.  It is available at https://doi.org/10.6028/NIST.IR.8240 <https://doi.org/10.6028/NIST.IR.8240>.

---

From: Joachim Strömbergson <[email-masked]>
Date: Thu, 31 Jan 2019 19:46:13 +0100

Aloha!

On 2019-01-31 16:51, Russ Housley wrote:
> NIST just posted NISTIR 8240, the Status Report on the First Round of
> the NIST Post-Quantum Cryptography Standardization Process.  It is
> available at https://doi.org/10.6028/NIST.IR.8240.

And here is the list of candidates moving to the second round:

https://csrc.nist.gov/news/2019/pqc-standardization-process-2nd-round-candidates

>From the page:

The 17 Second-Round Candidate public-key encryption and
key-establishment algorithms are:
    BIKE
    Classic McEliece
    CRYSTALS-KYBER
    FrodoKEM
    HQC
    LAC
    LEDAcrypt (merger of LEDAkem/LEDApkc)
    NewHope
    NTRU (merger of NTRUEncrypt/NTRU-HRSS-KEM)
    NTRU Prime
    NTS-KEM
    ROLLO (merger of LAKE/LOCKER/Ouroboros-R)
    Round5 (merger of Hila5/Round2)
    RQC
    SABER
    SIKE
    Three Bears

The 9 Second Round Candidates for digital signatures are:
    CRYSTALS-DILITHIUM
    FALCON
    GeMSS
    LUOV
    MQDSS
    Picnic
    qTESLA
    Rainbow
    SPHINCS+

-- 
Med vänlig hälsning, Yours

Joachim Strömbergson - Alltid i harmonisk svängning.
========================================================================

---

From: "Blumenthal, Uri - 0553 - MITLL" <[email-masked]>
Date: Thu, 31 Jan 2019 21:23:59 +0000

I personally am surprised that there are no AKE schemes - only KEM (and while you can construct an AKE from a KEM, it's usually non-trivial and expensive).

Any idea why AKE weren't submitted...?

On 1/31/19, 13:47, "Cfrg on behalf of Joachim Strömbergson" <[email-masked] on behalf of [email-masked]> wrote:

    Aloha!

    

    
    
    _______________________________________________
    Cfrg mailing list
    [email-masked]
    https://www.irtf.org/mailman/listinfo/cfrg

---

From: "Scott Fluhrer (sfluhrer)" <[email-masked]>
Date: Fri, 1 Feb 2019 00:25:51 +0000

I believe that's because NIST didn't ask for an AKE; only KEMs, public key encryption and signature algorithms.

I believe that NISTs reasoning was "let's nail down the most basic and most commonly used primitives first; then we can worry about the fancier ones (such as AKE, IBE, (partially) homeomorphic encryption, etc)"

Now, I suppose someone could have submitted a KEM with a side input that would act as an AKE; however, no one did...

> -----Original Message-----
> From: Cfrg <[email-masked]> On Behalf Of Blumenthal, Uri - 0553 -
> MITLL
> Sent: Thursday, January 31, 2019 4:24 PM
> To: [email-masked]
> Subject: Re: [Cfrg] NIST Report on 1st Round of PQ Algorithms
> 
> I personally am surprised that there are no AKE schemes - only KEM (and
> while you can construct an AKE from a KEM, it's usually non-trivial and
> expensive).
> 
> On 1/31/19, 13:47, "Cfrg on behalf of Joachim Strömbergson" <cfrg-
> [email-masked] on behalf of [email-masked]> wrote:
> 
>     Aloha!
>