Session Date/Time: 24 Jul 2025 15:00

CFRG Meeting Minutes - IETF 123

Summary

The CFRG meeting at IETF 123 featured discussions on hybrid key encapsulation mechanisms (KEMs), post-quantum KEMs including Intrue and Classic McEliece, updates on blind signatures, zero-knowledge proofs for small identity theorems, Sigma Protocols, AEAD algorithms, and post-quantum password authenticated key exchange (PAKE). A key focus was on defining the problems that CFRG should address, balancing security and performance, and determining the appropriate venue for standardization work.

Key Discussion Points

Hybrid KEMs:
- Discussion centered around the trade-offs between different combiner constructions (GHP, pre, QSF).
- A question was raised whether to proceed with three different combiners or consolidate.
- Deterministic key generation and hash function selection (SHA2 vs. SHA3) were debated in the context of the LAMPS draft.
- It was suggested that an interim meeting would be beneficial to refine this draft.
Post-Quantum KEMs (Intrue and Classic McEliece):
- Debate around problem definition - what problem(s) would be solved by standardizing more PQ KEMs in CFRG beyond NIST selections?
- Is CFRG the correct venue to pursue this work or should it be done in a different group, possibly even at the IETF instead of the IRTF?
- Need for a requirements document to guide the selection of PQ KEMs.
- Discussion of whether engineers have the tools to choose KEMs for their specific needs.
- Security and performance comparisons between Intrue, McEliece, and other KEMs.
- Concerns about the mathematical assumptions and their implications if one is broken.
Blind Signatures:
- Updates on the core scheme and pseudonym functionalities.
- Concern about compromised privacy due to the potential for discrete logarithm computation.
- A polynomial approach was suggested to mitigate this issue by introducing multiple pseudonyms, but that introduced a proof size increase.
Zero-Knowledge Proofs for Small Identity Theorems:
- Need to research and develop post-quantum zero-knowledge schemes suitable for applications like digital identity wallets and age verification.
- Discussion on the level of abstraction needed to create usable tools.
Sigma Protocols:
- Update on progress since last meeting, including call for adoption.
- Clarification regarding the scope and relationship between the Sigma Protocol and Fiat-Shamir transform specifications.
- Debate over which curves should be supported.
- A push to limit the complexity and scope to encourage interoperability, while still allowing for extensions.
AEAD Algorithms (Roka-S and Chacha20-Poly1305):
- Presentation of new parallel modes for Roka-S for performance improvement.
- Proposal to update Chacha20-Poly1305 for enhanced security and performance using Poly 1.1, to include other properties defined in RFC 9771
Post-Quantum PAKEs:
- Presentation of a hybrid post-quantum password authenticated key exchange (PAKE) protocol named Spacequake.
- Considered the interest in the protocol, and if it should be handled in CFRG or a seperate IETF working group.

Decisions and Action Items

Virtual Interim Meeting: The Chairs will take to the list the suggestion to have a virtual interim meeting in September to move the Hybrid KEM draft along.
Meta-Analysis Draft: There was not anyone at the meeting, but the Chairs are open to the list suggesting someone who will perform a meta-analysis comparing the security reductions and proofs of different candidate KEMs.

Next Steps

Authors of hybrid KEM drafts to address feedback from the list and meeting, and aim for a new draft version within a month.
The list to determine the next steps of the post quantum KEM suggestions.
Authors to refine draft for Sigma Protocols following the feedback.
Take feedback from the discussion to the list to determine interest in a work item for post-quantum PAKEs