Pascal Schärli

@pascscha.ch

73 Followers 140 Following

Cryptography Engineer at ELCASecurity, privacy enjoyer and tinkerer. https://schaerli.org

Dear NIST PQC Team, I am commenting on NIST IR 8547, Transition to Post-Quantum Cryptography Standards. I have two remarks: 1. HARVEST NOW DECRYPT LATER I suggest adapting Table 4 to add deprecation of key establishment schemes also with >= 128 bits of security in 2030. While harvest now decrypt later attacks are covered and explained throughout the report, these differences are not reflected in Tables 2 and 4, where both signature schemes and key establishment schemes have the same migration timeline. The timeline in Table 4 is fine when the established keys are used for short-lived encrypted data or message authentication codes. However, when used for encryption of data where "harvest now decrypt later" is applicable, the transition of these key establishment techniques should be prioritized. This nuance is only reflected in the text and is lost in Tables 2 and 4, which is realistically the main point of reference that most organizations will implement. Either Table 4 should be adapted as per my suggestion, or the Table should differentiate what the established keys of these schemes are being used for. However, this might add too much complexity, hence my suggestion of simply adding depreciation in 2030 for all key establishment schemes listed in Table 4, regardless of their parametrization.