[openpgp] Re: I-D Action: draft-ietf-openpgp-nist-bp-comp- 00.txt

Simon Josefsson <[email protected]> Sat, 11 Oct 2025 13:23:30 +0200
Newsgroups	gmane.ietf.openpgp
Message-ID	<[email protected]>
I like that this document moves NIST/BSI curves out from the main
document, and also that they target the MAY level, so +1 since I think
we need more PQ hyrid options around.  I wish that PGP would use a
CFRG-aligned PQ/T combiner, but I also believe CFRG has proven itself
not worthy to wait for guidance on this matter.  While I prefer the
Chempat combiner I think it is reasonable to proceed with a custom
PGP-specific combiner here.  I also found alignment of MLKEM768 with
P384 and brainpoolP256 surprising, but I don't care strongly about that.

/Simon

Falko Strenzke <[email protected]> writes:

> After the adoption of draft-ietf-openpgp-nist-bp-comp, we would like
> to initiate the discussion about the code points. The draft currently
> has
>
> 5 for encryption:
>
> ML-KEM-512+ECDH-NIST-P-256 	MAY
> ML-KEM-768+ECDH-NIST-P-384 	MAY
> ML-KEM-1024+ECDH-NIST-P-384 	MAY
> ML-KEM-768+ECDH-brainpoolP256r1 	MAY
> ML-KEM-1024+ECDH-brainpoolP384r1 	MAY
>
> 5 for signature:
>
> ML-DSA-44+ECDSA-NIST-P-256 	MAY
> ML-DSA-65+ECDSA-NIST-P-384 	MAY
> ML-DSA-87+ECDSA-NIST-P-384 	MAY
> ML-DSA-65+ECDSA-brainpoolP256r1 	MAY
> ML-DSA-87+ECDSA-brainpoolP384r1 	MAY
>
> Please respond on the list whether you agree or disagree with these
> sets. Questions or discussions about the motivations etc. are of
> course also welcome.
>
> @Chairs: Can we plan a slot at the end of the interim next week to
> discuss the code points?
>
> That being said, I also encourage the WG to read the draft in
> general. Since it is fully aligned with draft-ietf-openpgp-pqc, the
> potential for discussions is probably low. The code points are
> presumably the main discussion point. Once the code points have been
> agreed on, the draft can probably progress quickly.
>
> If you want to review the draft, I suggest to wait until version 01,
> as we are currently in the process of applying the latest relevant
> editorial changes that have been made to draft-ietf-openpgp-pqc.
>
> Falko
>
> Am 09.10.25 um 16:18 schrieb [email protected]:
>> Internet-Draft draft-ietf-openpgp-nist-bp-comp-00.txt is now available. It is
>> a work item of the Open Specification for Pretty Good Privacy (OPENPGP) WG of
>> the IETF.
>>
>>     Title:   PQ/T Composite Schemes for OpenPGP using NIST and Brainpool Elliptic Curve Domain Parameters
>>     Authors: Quynh Dang
>>              Stephan Ehlen
>>              Stavros Kousidis
>>              Johannes Roth
>>              Falko Strenzke
>>     Name:    draft-ietf-openpgp-nist-bp-comp-00.txt
>>     Pages:   29
>>     Dates:   2025-10-09
>>
>> Abstract:
>>
>>     This document defines PQ/T composite schemes based on ML-KEM and ML-
>>     DSA combined with ECDH and ECDSA algorithms using the NIST and
>>     Brainpool domain parameters for the OpenPGP protocol.
>>
>> The IETF datatracker status page for this Internet-Draft is:
>> https://datatracker.ietf.org/doc/draft-ietf-openpgp-nist-bp-comp/
>>
>> There is also an HTML version available at:
>> https://www.ietf.org/archive/id/draft-ietf-openpgp-nist-bp-comp-00.html
>>
>> Internet-Drafts are also available by rsync at:
>> rsync.ietf.org::internet-drafts
>>
>>
>> _______________________________________________
>> openpgp mailing list [email protected]
>> To unsubscribe send an email [email protected]

_______________________________________________
openpgp mailing list -- [email protected]
To unsubscribe send an email to [email protected]
signature.asc (application/pgp-signature, 1.2 KB)