3 ms·

djb suggested that for openssh instead of the tinydns kex, so tinydns switched also: https://github.com/janmojzis/tinyssh/issues/50 https://github.com/janmojzi

djb suggested that for openssh instead of the tinydns kex, so tinydns switched also: https://github.com/janmojzis/tinyssh/issues/50 https://github.com/janmojzis/tinyssh/issues/50

chasil 5y ago
What is even more surprising about this promotion is that NTRU Prime is not a finalist. https://csrc.nist.gov/Projects/post-quantum-cryptography/round-3-submissions https://csrc.nist.gov/Projects/post-quantum-cryptography/rou... It appears there have been major disagreements in this process. "Formal complaint regarding 8 June 2021 incident - 2021.06.15, Daniel J. Bernstein "Executive summary. A week ago Dr. Daniel Apon from NIST publicly accused me of professional misconduct. Specifically, he accused me of initiating private contact with NIST so as to provide false information to NIST regarding the timing of an upcoming announcement relevant to NIST’s ongoing decisions..."
- adrian_b 5y ago
  Thanks for pointing to this conflict between Daniel J. Bernstein and NIST. It is interesting. After reading the complaint and the official comments from NIST, I choose to believe that Daniel Bernstein is the one saying the truth. Like in all his writings, Bernstein's version of the events is a very detailed list of precise, easily verifiable facts, while the version of the opponents consists only of vague, evasive claims. Regarding the reason why NTRU Prime has been selected only as an "Alternate Candidate" and not as a "Round 3 Finalist", this has been explained very clearly by NIST. There is no known weakness in NTRU Prime, but NIST demands additional research results about the possible attacks against NTRU Prime and against the current finalists, before considering the standardization of NTRU Prime. While there are some plausible arguments why NTRU Prime might be more secure than NTRU and similar methods, there is no certain proof of this, yet. What NIST demands is very reasonable, but nevertheless this does not seem to be a good justification for the selection of the finalists. As NIST says, the finalists include 3 algorithms like NTRU, for which it is possible that someone will find in the future an attack which will work against all 3. Also as NIST says, someone might find in the future a different attack which will work against NTRU Prime. NIST acknowledges that for now they do not have any idea about which of these 2 will happen first, if at all. A wiser decision would have been to not put all the eggs in one basket and also select NTRU Prime as a finalist, possibly instead of one of the algorithms with a similar construction like NTRU. This would have stimulated additional research on both kinds of algorithms. Now if someone finds an attack against NTRU-like algorithms, there are fewer alternatives between the finalists.
  - chasil 5y ago
    It appears that the market is going to choose NTRU Prime in precedence of whatever NIST endorses. OpenSSH is a huge vote of confidence, and it appears that it is rightly placed. However, when executing a flat-file signature with OpenSSH, the result will not be protected from a quantum attack.

djb suggested that for openssh instead of the tinydns kex, so tinydns switched also: https://github.com/janmojzis/tinyssh/issues/50 https://github.com/janmojzis/tinyssh/issues/50

chasil 5y ago

What is even more surprising about this promotion is that NTRU Prime is not a finalist. https://csrc.nist.gov/Projects/post-quantum-cryptography/round-3-submissions https://csrc.nist.gov/Projects/post-quantum-cryptography/rou... It appears there have been major disagreements in this process. "Formal complaint regarding 8 June 2021 incident - 2021.06.15, Daniel J. Bernstein "Executive summary. A week ago Dr. Daniel Apon from NIST publicly accused me of professional misconduct. Specifically, he accused me of initiating private contact with NIST so as to provide false information to NIST regarding the timing of an upcoming announcement relevant to NIST’s ongoing decisions..."

adrian_b 5y ago
Thanks for pointing to this conflict between Daniel J. Bernstein and NIST. It is interesting. After reading the complaint and the official comments from NIST, I choose to believe that Daniel Bernstein is the one saying the truth. Like in all his writings, Bernstein's version of the events is a very detailed list of precise, easily verifiable facts, while the version of the opponents consists only of vague, evasive claims. Regarding the reason why NTRU Prime has been selected only as an "Alternate Candidate" and not as a "Round 3 Finalist", this has been explained very clearly by NIST. There is no known weakness in NTRU Prime, but NIST demands additional research results about the possible attacks against NTRU Prime and against the current finalists, before considering the standardization of NTRU Prime. While there are some plausible arguments why NTRU Prime might be more secure than NTRU and similar methods, there is no certain proof of this, yet. What NIST demands is very reasonable, but nevertheless this does not seem to be a good justification for the selection of the finalists. As NIST says, the finalists include 3 algorithms like NTRU, for which it is possible that someone will find in the future an attack which will work against all 3. Also as NIST says, someone might find in the future a different attack which will work against NTRU Prime. NIST acknowledges that for now they do not have any idea about which of these 2 will happen first, if at all. A wiser decision would have been to not put all the eggs in one basket and also select NTRU Prime as a finalist, possibly instead of one of the algorithms with a similar construction like NTRU. This would have stimulated additional research on both kinds of algorithms. Now if someone finds an attack against NTRU-like algorithms, there are fewer alternatives between the finalists.
- chasil 5y ago
  It appears that the market is going to choose NTRU Prime in precedence of whatever NIST endorses. OpenSSH is a huge vote of confidence, and it appears that it is rightly placed. However, when executing a flat-file signature with OpenSSH, the result will not be protected from a quantum attack.