Pascal Schärli
LightNews LightNews
pascscha.ch
Pascal Schärli
@pascscha.ch
53 followers 140 following 11 posts
Cyber security master's graduate from ETH Zürich, now a dedicated Cryptography Engineer with a strong passion for coding and scripting.

https://schaerli.org
Posts Replies Media Videos
pascscha.ch
NIST still accepts comments about this draft, so I've decided to write out my concerns and sent them an email to provide feedback. I know there are much more notable people than me that are going to comment on this, but I thought the experience might be interesting. Here is what I wrote:
Dear NIST PQC Team, I am commenting on NIST IR 8547, Transition to Post-Quantum Cryptography Standards. I have two remarks: 1. HARVEST NOW DECRYPT LATER I suggest adapting Table 4 to add deprecation of key establishment schemes also with >= 128 bits of security in 2030. While harvest now decrypt later attacks are covered and explained throughout the report, these differences are not reflected in Tables 2 and 4, where both signature schemes and key establishment schemes have the same migration timeline. The timeline in Table 4 is fine when the established keys are used for short-lived encrypted data or message authentication codes. However, when used for encryption of data where "harvest now decrypt later" is applicable, the transition of these key establishment techniques should be prioritized. This nuance is only reflected in the text and is lost in Tables 2 and 4, which is realistically the main point of reference that most organizations will implement. Either Table 4 should be adapted as per my suggestion, or the Table should differentiate what the established keys of these schemes are being used for. However, this might add too much complexity, hence my suggestion of simply adding depreciation in 2030 for all key establishment schemes listed in Table 4, regardless of their parametrization. 2. HYBRID MODE I suggest clarifying in Tables 2 and 4, that deprecation and disallowment do not apply if schemes are used in hybrid mode (i.e., within SP 800-56C once it's updated). Furthermore, in Tables 3 and 5, I suggest specifying that post-quantum algorithms have to be used in hybrid mode with conventional algorithms of at least the same security category. Quantum algorithms are still lacking maturity and face implementation flaws, such as those exploited by KyberSlash. While the report acknowledges that the migration to post-quantum cryptography may initially include hybrid solutions, this is not reflected in Tables 2-5. You present several arguments against using hybrid schemes, such as the complexity they add to implementations and architectures. I disagree with this argument, as the construction of hybrid modes for signatures or key encapsulation methods is not very complex. I also disagree with the argument that using hybrid modes will necessitate a second transition to tools that use Post-Quantum Cryptography algorithms only. There is no security gain in removing the pre-quantum algorithm, so there will be no need to migrate existing algorithms that use hybrid approaches. By implementing these two suggestions, we can ensure that these important points are also reflected in the Tables, which will likely be the main point of reference for most readers. This will help provide clarity and guidance for organizations navigating the transition to post-quantum cryptography. Regards, Pascal Schärli
November 30, 2024 at 2:24 PM