@letoams
No. I am sticking with position, which you said IETF has, of not producing anything pure pq, i.e. non hybrid, as it is too risky, and not as conservative.
Dropping non-pq can occur only when quantum computers are all around us. Till then, even RECOMMENDED=N from IETF is careless, at best.
Re-adding @djb
@mikalai @pluralistic @eff
I am glad I convinced you that you have a single argument, abd that the other assumptions were just a distraction. Luckily, that argument has been extensively discussed at the list already over the course of two years.
Btw you should asap object to draft-ietf-ipsecme-ikev2-mlkem as it allows peers to decide at runtime whether to use pure mlkem or a hybrid.
@letoams
My main point is that till there are actual quantum computers, not having non-pq is irresponsible.
Also, calling a consensus on split decisions, without providing details in the same sentence, is missleading.
@djb is right on this.
At this point, clearly you are attempting to play the fact that your are more detailed in minutia of IETF. It feels that way. I respectfully decline invitation. It is Saturday, and it feels that IETF is not a friend. Yaks.
Replying to @mikalai@privacysafe.social
@letoams
And also, want to reiterate (noting your rethorical skill to draw attention from important points, by quick summarization) you, IETF make something, then world around implents following trust in you, but when bugs in pq are found, and there is no non-pq, CSO's like me will be blamed.
I want this responsibility shift to be clearly recognized.
Please, don't be ignorant of this effect.
Now, in a big company, CSO may survive. Small company will be eaten by big one.
@mikalai @djb @pluralistic @eff I am the owner of the crypto / TLS / IPsec security at our company running 200k Linux nodes across the world. Don’t you think those same concerns apply to me ?
@letoams
Than you have a higher risk tolerance.
But your decision will have repercussions to all of us.
Hence, begging for more conservatism, i.e. no pure-pq anything till quantum computers actually materialize.
I, personally, had a glass of vine at IQC opening, 24-25 years ago. Institute for Quantum Computation. It was well after refactoring 15 by IBM. Still waiting for miracle. I mean, by now it feels like miracle/mirage.