News for hackers. Stuff that matters.
Re:NSA, NIST, and post-quantum crypto: my second lawsuit aga... by chasil on Saturday August 06, 2022 @03:27AM (#32365819)
The main concern that I have is the NIST refusal to consider a hybrid design as described in the blog, coupled with the fact that OpenSSH has disregarded NIST and standardized on hybrid NTRU-Prime.

There had to be substance to accomplish this, and it moves all of UNIX plus Microsoft away from crystals. It would seem hugely damaging to crystals as the winner of the latest round.

Re:NSA, NIST, and post-quantum crypto: my second lawsuit aga... by tptacek on Saturday August 06, 2022 @03:32AM (#32365853)
I don't think you understand what's going on here. The point of the PQC "contest" is to figure out which PQC constructions to use. It's not to design hybrid classical/PQC schemes: everybody already knows how to do that. The idea that NIST should have recommended CRYSTALS-Kyber+Curve25519 is a little like suggesting that they should have recommended Rijndael+DES-EDE.

It's simply not NIST's job to tell tls-wg how to fit PQC into HTTPS, or the OpenSSH team how to fit it into SSH.

If you trust the OpenSSH team more than NIST, that's fine. I think that's a reasonable thing to do. Just do whatever OpenSSH does, and you don't have to worry about how corrupt NIST's process is. I don't even think NIST is corrupt, and I still think you'd be better off just paying attention to whatever OpenSSH does.

Re:NSA, NIST, and post-quantum crypto: my second lawsuit aga... by chasil on Saturday August 06, 2022 @03:48AM (#32365949)
That would make it seem that the lengthy hybrid discussion in the blog is a misdirection.

I will grant you that this does support your argument.

EDIT: Actually, what you have said does not seem at all correct.

In DJB's Apon complaint, we find this text:

'For example, in email to pqc-forum dated 30 Oct 2019 15:38:10 +0000 (2019), NIST posted technical comments regarding hybrid encryption modes and asked for feedback “either here on the pqc-forum or by contacting us at [email protected]” (emphasis added).'

If hybrid encryption is entirely beyond the purview of the NIST PQC competition, then why did this discussion and feedback request ever take place?

Re:NSA, NIST, and post-quantum crypto: my second lawsuit aga... by tptacek on Saturday August 06, 2022 @10:21AM (#32368335)
Look, I'm just not going to dignify the argument that there is somehow some controversy over the NIST PQC contest not recommending higher-level constructions to plug PQC KEMs into Curve25519 key exchanges. I get that this seems like a super interesting controversy to you, because Bernstein's blog post is misleading you, but this simply isn't a real controversy.
Re:NSA, NIST, and post-quantum crypto: my second lawsuit aga... by chasil on Saturday August 06, 2022 @01:20PM (#32369873)
Hopefully, the judge will help, as before.
Re:NSA, NIST, and post-quantum crypto: my second lawsuit aga... by tptacek on Saturday August 06, 2022 @03:40PM (#32370938)
It's somewhat unlikely that there will even be a judge here.
Re:NSA, NIST, and post-quantum crypto: my second lawsuit aga... by djmdjm on Saturday August 06, 2022 @06:00AM (#32366627)
Repeating this here. We (OpenSSH) have not disregarded NIST, we just added a PQ algorithm before NIST finished their competition and we'll almost certainly add support for the finalist fairly soon.
Re:NSA, NIST, and post-quantum crypto: my second lawsuit aga... by chasil on Saturday August 06, 2022 @01:31PM (#32369954)
I will eagerly await their arrival, and be sure to sysupgrade.