Post quantum cryptography

[forty]

Hello,

Is there any plan to add PQ algorithms to libsodium? I feel it would be nice to have nicely packaged hybrid algorithms using the PQ algorithms selected by NIST last year for example https://csrc.nist.gov/Projects/post-quantum-cryptography/selected-algorithms-2022 ?

The only discussion on the topic I found is #371 which is from 2016, but I might have missed others (sorry if I did, I'm happy to read them if they exist).

See some discussion on the topic by Age author https://words.filippo.io/dispatches/post-quantum-age/

[jedisct1]

Not until Kyber is finalized.

What we have now is very unlikely to be what NIST will standardize.

[jedisct1]

The current version of Kyber is not even the one described in that Filipo's post any more (it's now using SHAKE as a hash function).

You can (and should!) run experiments with it, but using it for production deployments would be premature. So would its inclusion in libsodium, that tries to avoid breaking changes.

[forty]

I understand, thanks for the explanation.

[mhemmings]

NIST have just finalised standards:
https://www.nist.gov/news-events/news/2024/08/nist-releases-first-3-finalized-post-quantum-encryption-standards

[samuel-lucas6]

However, there's no non-interactive key exchange (NIKE), I don't think people are that happy with the signature schemes, and Round 4/Standardization of Additional Digital Signature Schemes are ongoing.

If a library isn't careful with which PQC algorithms and parameter sets to support, it'll end up becoming a kitchen sink. For this type of library, it's not necessarily something to rush into. Having said that, PQC algorithms aren't one size fits all algorithms so maybe this is unavoidable to an extent.

[jedisct1]

There's no standardized hybrid scheme (which is what everybody wants to use, not ML-KEM alone) either yet.

[forty]

Hi @jedisct1, happy new year! Just want to point out this (not new at all - 12/2020 - but I was not aware, so I'm sharing in case you were not either) standardized hybrid scheme which seems serious and recommended by the ANSSI https://www.etsi.org/deliver/etsi_ts/103700_103799/103744/01.01.01_60/ts_103744v010101p.pdf (not sure if that was still a blocking point for PQ crypto inclusion, and if European bodies standard can be considered or if we have to wait for NIST's blessing)

[jedisct1]

unsubscribe.

[R1kaB3rN]

The OP asked a close-ended question more than 1 year ago:

Is there any plan to add PQ algorithms to libsodium?

Which was left unanswered, so devs looking for PQC solutions should assume the worst and move on. Instead of pinging for updates, either consider another library or make a PR for the feature.

[samuel-lucas6]

ML-KEM is on the roadmap. The problem is PQC is a lot more complicated than just implementing one primitive. For starters, libraries like libsodium and Monocypher are Bernstein centric, meaning they also have to implement things like SHAKE and SHA-3 to implement ML-KEM. That's more code, more tests, more documentation, and more user confusion. Then there's the fact that ML-KEM is not necessarily the best/only choice, and the NIST process is still ongoing for both KEMs and signatures. Then lots of people want to use hybrid schemes, like ML-KEM + X25519, which requires that to be standardised and perhaps only an API for a hybrid scheme should be provided instead of for ML-KEM alone.

could break ECC encryption very soon

This is also incorrect. If you listen to informed people's opinions, the estimates are typically 2035-2040 (10-15 years). BSI has just done a study suggesting cryptographically relevant quantum computers will probably be available within 16 years. If the NSA can wait until 2030-2035 (5-10 years) to be fully quantum-resistant, you don't need to panic.

[moscowchill]

Thanks for the work!
https://github.com/moscowchill/c-toxcore-pq
Working on adding libsodium ML-KEM to Tox!