[saag] Re: [Ext] Re: draft-paulwh-crypto-components-02

(Doing that weird thing of responding to my co-author on-list)

On Feb 14, 2025, at 06:20, Paul Wouters <[email protected]> wrote:

> The recent past (eg non-pq) shows a narrowing of algorithms to mostly be 1 NIST and 1 non-NIST algorithm.

Defining "NIST algorithm" is both time-dependent and error-prone. I prefer to think of what many WGs do is "look at what NIST has done, see if there is anything that is widely-believed to be better, and pick". X25519 and friends is an excellent example of this.

> I don't see this document changing that.

Agree.

> Of course, the non-NIST set of algorithms doesn't have the oversight
> from a NIST-like body, so we will likely have more arguments on which non-NIST algorithm is preferred.

It is not oversight that is important when WGs pick algorithms: it is review. NIST competitions cause good review, but the result of the NIST-sponsored review can be flawed because NIST ends up picking things that work best for the US government at the moment. The review that happens in the CFRG and other such groups augments the review caused by the NIST competition, and can result in choices that NIST didn't or wasn't allowed to make.

> This
> draft basically just re-states we dont want a zillion non-NIST algorithms.

To me, that's too narrow of a conclusion. The draft says that we don't want a zillion algorithms, regardless of source. A concrete example of this is that the IETF didn't embrace many of the NIST EC algorithms such as the Koblitz curves.

> ps. this reasoning is also why it makes sense that WGs introduce PQ algorithms as MAY and not SHOULD.

Based on the other responses, it's clear we need to expand the draft to describe how WGs might specify mandatory to implement algorithms.

--Paul Hoffman

_______________________________________________
saag mailing list -- [email protected]
To unsubscribe send an email to [email protected]