Support Cryptographic Right Answers Post Quantum Edition (2024)

[randomstuff]

Many things not mentioned in the Support Cryptographic Right Answers Post Quantum Edition (2024) post are not mentionned in the crypto appendix.

For example:

• ML-DSA-, Falcon-, Ed25519
• ML-KEM-
• X25519
• XSalsa20

Should these at least be mentioned as "approved"?

This is relevant for post quantum cryptography support.

Disclaimer: I don't know much about these.

Other topics

• Random IDs Use 256-bit random numbers → at least for L3, the length requirements should probably be upped when possible.

Possibly other things to consider, I've only skimmed the post for now.

Topic	What is in the document	What we have	Comments
Encrypting Data	XSalsa20+Poly1305	ChaCha20	Mention Salsa20, XSalsa20, XChaCha20? Mention Poly1305 in the MAC section?
Symmetric key length	256 bit keys	128 bits / 112 bits	Should we increase the 128/112 bits at least for L3?
Hashing Algorithm	SHA-2	SHA-2, etc.	OK
Symmetric “Signatures”	HMAC	HMAC, etc .	OK
Random IDs	256 bit	We talk about UUID	Explicitely increase this value (for L2? L3?)
Password Handling	argon2id, scrypt, bcrypt, PBKDF2		OK
Key Exchange	X25519+ML-KEM-768 or P256+ML-KEM-768	DH including Curve25519	Shall we add ML-KEM-768 somewhere?
Asymmetric Signatures	Nacl, Ed25519, Ed25519+ML-DSA-65, P256+ML-DSA-65		Add ML-DSA-65?

[randomstuff]

Related to #2293

[danielcuthbert]

Good catch and ill add this to my sprint

[tghosth]

@randomstuff is this for the appendix or for the chapter itself?

[randomstuff]

The list of ciphers and other cryptographic mechanisms would be for the appendix. Other considerations might motivate changes in the crypto requirements (eg. the random ID thing).

[danielcuthbert]

Amended 6.9.1 to be more reflective of current efforts in the PQC space. #2371
The random ID one still needs to be looked into further

[randomstuff]

@danielcuthbert, Does it make it sense to include references to ML-DSA-, Falcon-, ML-KEM-, XSalsa20 in the allowed mechanisms?

[randomstuff]

Updated the issue description with a table recapitulating the content of the the post compared to what we have.

[danielcuthbert]

Going on what NIST is saying about PQC, we won't be adding specific names to the appendix yet except that PQC implementations must be inline with FIPS-203/204/205, as there isn't any hardened code nor implementation reference yet. https://www.nist.gov/news-events/news/2024/08/nist-releases-first-3-finalized-post-quantum-encryption-standards

We will be monitoring this and amend in due course