Content-Type: text/html; charset=windows-1252 Content-Language: en-US Content-Transfer-Encoding: 8bit

Hi Dustin,

I have just a few comments on the slides.

On slide 4, for the PQC survey paper, Ray's name should be listed first. He was definitely the primary author on that paper.

Slide 11 - Should there be some mention of public key size and signature/ciphertext size? Performance in terms of run time did not play a major role, since we didn't have optimized implementations, so couldn't know the "true" performance of the algorithms. However, better implementations won't affect the sizes of public keys and signatures/ciphertext, and as others have commented, in many cases the communication costs associated with these sizes may have a greater impact on overall performance than the costs of the internal computations. PQRSA would have been considered unacceptable as a result of the key and signature/ciphertext sizes even if the internal computations could have been performed quickly. In other cases, when choosing between similar submissions, the ones with smaller key and ciphertexts were preferred.

Slide 22 says "Feb 2019 - If another shutdown occurs, the PQC project will not be shutdown." Perhaps Matt has already approved this language, but I would suggest not saying it. While Matt made that statement about our project a few weeks ago, just before the spending bill was passed, another shutdown can't happen for at least 7 months, and it doesn't seem safe to assume that the thinking that applied in mid-February will still apply then. Also, even if the PQC project itself were exempted, the project could still be impacted by the shutdown.

Slide 31 - LMS is in the RFC editor queue.

Slide 34 - there are 17 encryption/KEN algorithms and 9 signature algorithms.

On 3/7/19 11:32 AM, Moody, Dustin (Fed) wrote:

Everyone,

I’ll be giving a talk in two weeks at a PQC workshop, and came up with some new slides for a talk. It goes into more of our decision making process during Round 1. Please take a look – and let me know your suggestions (by next Thursday 3/14). I’ll probably use this as the base for our talk at PQCrypto in May as well.

Dustin