tireddy2 / pqc_uta

Post-Quantum Cryptography Recommendations for Internet Applications

This is the working area for the individual Internet-Draft, "Post-Quantum Cryptography Recommendations for Internet Applications".

• Editor's Copy
• Datatracker Page
• Individual Draft
• Compare Editor's Copy to Individual Draft

Contributing

See the guidelines for contributions.

Contributions can be made by creating pull requests. The GitHub interface supports creating pull requests using the Edit (✏) button.

Command Line Usage

Formatted text and HTML versions of the draft can be built using make.

$ make

Command line usage requires that you have the necessary software installed. See the instructions.

pqc_uta's Issues

Only HPKE authenticated mode requires NIKE

The unauthenticated HPKE modes have been defined using KEM primitives, and it's very easy to slot post-quantum KEM into them. The authenticated modes require AKEM or NIKE primitives, for which we don't really have good solutions right now.

Why does email not require confidentiality?

The section on email submission makes a reference to ECH, which I do not understand, but otherwise states that "there are no specific recommendations for SUBMISSION beyond {{ech}}".

HTTPS is fully delved into and has the exact same requirements as email submission: note that email submission also often involves the exchange of authentication tokens or passwords!

"Applications MUST use TLS 1.3"

Can UTA make such bold requirements?

TLS alert mechanisms

If the TLS server is not happy with pre-quantum algorithms, then it should simply send the "insufficient_security" alert defined in RFC 8446 and terminate the connection. Otherwise you're still establishing a TLS connection with bad security, which seems like the kind of thing that we got rid of when browsers stopped letting you just click through the "bad certificate" warnings.

Mixed use of "hybrid" and "PQ/T"

E.g. section "Authentication" uses PQ/T, but the section on data confidentiality only uses "hybrid"

Discuss CSR, ACME and CMP.

@OR13 I think it would be worth teasing apart the CA / signing issues with CRQCs from the encryption ones, perhaps a diagram or 2 could help here.