Add files via upload

draft-ietf-pquip-pqc-engineers.md

@@ -686,7 +686,7 @@ The frequency and duration of system upgrades and the time when CRQCs will becom
 
 ## Additional Considerations
 
-It is also possible to use more than two algorithms together in a hybrid scheme, and there are multiple possible ways those algorithms can be combined.  For the purposes of a post-quantum transition, the simple combination of a post-quantum algorithm with a single classical algorithm is the most straightforward, but the use of multiple post-quantum algorithms with different hard math problems has also been considered.  When combining algorithms, it is possible to require that both algorithms be used together (the so-called "and" mode) or that only one does (the "or" mode), or even some more complicated scheme.  Schemes that do not require both algorithms to validate only have the strength of the weakest algorithm, and therefore offer little or no security benefit but may offer backwards compatibility, crypto agility, or ease-of-migration benefits.  Care should be taken when designing "or" mode hybrids to ensure that the larger PQ keys are not required to be transmitted to and processed by legacy clients that will not use them; this was the major drawback of the failed proposal {{?I-D.draft-truskovsky-lamps-pq-hybrid-x509}}.  This combination of properties makes optionally including post-quantum keys without requiring their use to be generally unattractive in most use cases. On the other hand, including a classical key -- particularly an elliptic curve key -- alongside a lattice key is generally considered to be negligible in terms of the extra bandwidth usage.
+It is also possible to use more than two algorithms together in a hybrid scheme, with various methods for combining them. For post-quantum transition purposes, the combination of a post-quantum algorithm with a classical algorithm is the most straightforward. The use of multiple post-quantum algorithms with different mathematical bases has also been considered. Combining algorithms in a way that requires both to be used together ensures stronger security, while combinations that do not require both will sacrifice security but offer other benefits like backwards compatibility and crypto agility. Including a traditional key alongside a post-quantum key often has minimal bandwidth impact.
 
 When combining keys in an "and" mode, it may make more sense to consider them to be a single composite key, instead of two keys.  This generally requires fewer changes to various components of PKI ecosystems, many of which are not prepared to deal with two keys or dual signatures.  To those protocol- or application-layer parsers, a "composite" algorithm composed of two "component" algorithms is simply a new algorithm, and support for adding new algorithms generally already exists.  Treating multiple "component" keys as a single "composite" key also has security advantages such as preventing cross-protocol reuse of the individual component keys and guarantees about revoking or retiring all component keys together at the same time, especially if the composite is treated as a single object all the way down into the cryptographic module.  All that needs to be done is to standardize the formats of how the two keys from the two algorithms are combined into a single data structure, and how the two resulting signatures or KEMs are combined into a single signature or KEM.  The answer can be as simple as concatenation, if the lengths are fixed or easily determined. At time of writing, security research is ongoing as to the security properties of concatenation-based composite signatures and KEMs vs more sophisticated signature and KEM combiners, and in which protocol contexts those simpler combiners are sufficient.