Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add TSC 2024-12-10 minutes #123

Open
wants to merge 2 commits into
base: main
Choose a base branch
from
Open

Add TSC 2024-12-10 minutes #123

wants to merge 2 commits into from

Conversation

bhess
Copy link
Member

@bhess bhess commented Dec 19, 2024

TSC meeting minutes from 2024-12-10.

Signed-off-by: Basil Hess <[email protected]>
- Discussion on whether to rely on OpenSSL’s upcoming SLH-DSA implementation or explore other upstream sources.
- Considerations include performance, diversity, formal verification, and composite use cases.
- Douglas will reach out to SPHINCS+ authors for input.
- Michael suggests exploring the option of dropping support for SLH-DSA.
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The complete context here was Christian's comment/question whether it is worthwhile continuing work on OQS at all given that not only SLH-DSA, but all standardized PQC algorithms are now being added to OpenSSL -- which OQS already now relies on/falls back to by default and for "beyond research use" cases.

I think this thought also needs to be captured in the minutes as a) also concerns me (and I think OQS users) and b) requires serious thought going forward: Sample questions: What use(r)s should OQS focus on/cater for? Does OQS want to compete with, complement or use OpenSSL? In general or differently per algorithm? In case of resource (people) contention, what to prioritize? The same question is valid (and already being answered) for oqs-boringssl: There the upstream code is being prioritized (unless I misunderstand the intentions by @pi-314159 -- maybe you want to chime in?).

Also, I think @dstebila rightfully mentioned that it'd be pretty pointless for oqs-provider to keep supporting algorithms that are already implemented by OpenSSL's default provider (if liboqs already gets its code from OpenSSL (default provider), so that also should be considered.

Either way, I think this warrants an action item (discussion in the near future how to prioritize to not waste development effort).

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Based on my understanding and usage (or @SWilson4's usage), we test different algorithms, with a particular focus on experimentation rather than production use.

If OQS' goal is to create a testbed or playground for exploring various cryptographic algorithms, then it remains meaningful and should continue to exist—perhaps even after NIST's standardization process. This would allow us to experiment with algorithms that are not standard, but have not been proven to have any security vulnerabilities.

However, if OQS' goal is to support production use, then we should consider dissolving this organization, as other projects like BoringSSL and OpenSSL have already implemented the relevant standards.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks, @baentsch, for pointing this out. I re-listened to that part of the recording and realized some context was indeed missing. I've now updated the minutes to include more detailed context from the conversation.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants