It had appeared that we were waiting for NIST. I wonder what changed.
"ssh(1), sshd(8): add the sntrup761x25519-sha512@openssh.com hybrid ECDH/x25519 + Streamlined NTRU Prime post-quantum KEX to the default KEXAlgorithms list (after the ECDH methods but before the prime-group DH ones). The next release of OpenSSH is likely to make this key exchange the default method."
2022/2024 Draft Standards Available
https://csrc.nist.gov/Projects/post-quantum-cryptography/wor...
https://csrc.nist.gov/Projects/post-quantum-cryptography/rou...
It appears there have been major disagreements in this process.
"Formal complaint regarding 8 June 2021 incident - 2021.06.15, Daniel J. Bernstein
"Executive summary. A week ago Dr. Daniel Apon from NIST publicly accused me of professional misconduct. Specifically, he accused me of initiating private contact with NIST so as to provide false information to NIST regarding the timing of an upcoming announcement relevant to NIST’s ongoing decisions..."
After reading the complaint and the official comments from NIST, I choose to believe that Daniel Bernstein is the one saying the truth.
Like in all his writings, Bernstein's version of the events is a very detailed list of precise, easily verifiable facts, while the version of the opponents consists only of vague, evasive claims.
Regarding the reason why NTRU Prime has been selected only as an "Alternate Candidate" and not as a "Round 3 Finalist", this has been explained very clearly by NIST.
There is no known weakness in NTRU Prime, but NIST demands additional research results about the possible attacks against NTRU Prime and against the current finalists, before considering the standardization of NTRU Prime.
While there are some plausible arguments why NTRU Prime might be more secure than NTRU and similar methods, there is no certain proof of this, yet.
What NIST demands is very reasonable, but nevertheless this does not seem to be a good justification for the selection of the finalists.
As NIST says, the finalists include 3 algorithms like NTRU, for which it is possible that someone will find in the future an attack which will work against all 3. Also as NIST says, someone might find in the future a different attack which will work against NTRU Prime.
NIST acknowledges that for now they do not have any idea about which of these 2 will happen first, if at all.
A wiser decision would have been to not put all the eggs in one basket and also select NTRU Prime as a finalist, possibly instead of one of the algorithms with a similar construction like NTRU.
This would have stimulated additional research on both kinds of algorithms. Now if someone finds an attack against NTRU-like algorithms, there are fewer alternatives between the finalists.
OpenSSH is a huge vote of confidence, and it appears that it is rightly placed.
However, when executing a flat-file signature with OpenSSH, the result will not be protected from a quantum attack.
However, the current worry is that a statistical attack will be found that will run on current quantum annealers (DWave).
https://www.bloomberg.com/news/features/2017-06-14/the-machi...
Whoops I meant this article.
https://www.forbes.com/sites/arthurherman/2021/06/07/q-day-i...