|
| 1 | +# OQS Technical Steering – 2024-12-10 – minutes |
| 2 | + |
| 3 | +## Attendees |
| 4 | + |
| 5 | +* Douglas Stebila (U Waterloo) |
| 6 | +* Spencer Wilson (U Waterloo) |
| 7 | +* Michael Baentsch (Intependent) |
| 8 | +* Brian Jarvis (Amazon) |
| 9 | +* Christian Paquin (Microsoft) |
| 10 | +* Norman Ashley (Cisco) |
| 11 | +* Alex Bozarth (IBM) |
| 12 | +* Basil Hess (IBM) |
| 13 | + |
| 14 | +## Agenda |
| 15 | + |
| 16 | +1. Chair's introduction |
| 17 | + |
| 18 | +- Introduction by Douglas. |
| 19 | + |
| 20 | +2. Approve agenda |
| 21 | + |
| 22 | +- No changes requested. |
| 23 | + |
| 24 | +3. Appoint minute-taker |
| 25 | + |
| 26 | +- Basil Hess |
| 27 | + |
| 28 | +4. Review action items from previous meeting |
| 29 | + |
| 30 | +- [Security response team](https://github.com/open-quantum-safe/tsc/issues/60) |
| 31 | + |
| 32 | +- Setup GitHub/email alias: Pending. |
| 33 | +- Dry run pending security response policy. Spencer and Douglas to discuss. |
| 34 | +- Spencer: Awaiting wet run of HQC incident; will draft process document (PR forthcoming). |
| 35 | +- Douglas: Solicit feedback, expecially from people with prior experience. |
| 36 | +- Michael: Suggests documenting guidelines on how to interact with upstream projects. Responsiveness from upstreams is a concern; to identify key contacts at upstreams. |
| 37 | + |
| 38 | +5. Reports (PQCA TAC, PQ Code Package) - Spencer |
| 39 | + |
| 40 | +- TAC discussion around supporting context strings in ML-KEM. Google's Tink library doesn't expose context string features, alghough Tink aims at providing higher-level API compared to liboqs. |
| 41 | +- PQCP mlkem-native version 1.0-alpha has been released, with Pravek and Basil working on its integration with OQS. |
| 42 | + |
| 43 | + |
| 44 | +6. [SLH-DSA and which upstream code bases to rely on](https://github.com/open-quantum-safe/liboqs/issues/1894) |
| 45 | + |
| 46 | +- Options presented are: Develop an independent implementation. Await availability from an upstream source. Utilize OpenSSL’s upcoming implementation. Exclude SLH-DSA entirely. |
| 47 | +- Michael shared that OpenSSL is developing its own SLH-DSA implementation from scratch, alongside including other PQ standard implementations. The SLH-DSA implementation won't be formally verified. |
| 48 | +- Christian raises question on the role of OQS once crypto libraries include own implementations of PQ standards. |
| 49 | +- Douglas outlines potential value propositions of liboqs: availability of a wide set of algorithms and formally verified implementations. The team brings up other propositions: performance-optimized (assembly) versions, and diversity of implementations. Brian notes that PQCP's ML-KEM implementation is formally verified. |
| 50 | +- Spencer notes that if including OpenSSL’s SLH-DSA implementation, the algorithms would not be able available to users disabling OpenSSL in the liboqs build. Questions on the sense of incorporating OpenSSL's implementation in oqs-provider were raised, circular dependencies might be another concerns. It might still be valuable to include for enabling constructions like composites. |
| 51 | +- Norm and Duc expressed interest in contributing to SLH-DSA implementation, potentially leveraging other upstream resources. |
| 52 | +- Michael emphasized considering the option to drop SLH-DSA support entirely, also for (CI) resources concerns. |
| 53 | +- Douglas will reach out to upstream providers such as SPHINCS+ and pqclean and drafting an approach for approaching upstreams, likely in the security policy discussion thread. |
| 54 | + |
| 55 | +7. [Binary distributions](https://github.com/orgs/open-quantum-safe/discussions/1625) |
| 56 | + |
| 57 | +- Ubuntu has expressed interest in including liboqs/oqs-provider but only with no plain PQ algorithms. This raises implications for configuration. |
| 58 | +- Action: Create a wiki/markdown page documenting binary distributions shipped. |
| 59 | +- Suggestion: Ensure GitHub contacts for communication are accessible. |
| 60 | + |
| 61 | +8. Other business |
| 62 | + |
| 63 | +- Agreement to set the ops-openssl 1.1.1 fork and liboqs-dotnet repositories to read-only status (archive). |
| 64 | +- Spencer to update the website with links to archived repositories, providing interested parties the ability to revive them if needed. |
| 65 | +- libssh to also be archived following consensus. |
| 66 | +- Question raised by Alex if the arm64 runner used in OQS is a self-hosted runner. Clarification provided that the project currently uses the GitHub-hosted beta runner, which may resemble a self-hosted instance. Alex will open a PR in the TSC repository to address this. |
0 commit comments