Dilithium2 incorrectly marked as level 1
dstebila opened this issue · 2 comments
The issue stems from
openssl/oqs-template/generatehelpers.py
Lines 68 to 76 in 907fdfd
if claims NIST L1 or L2 security, then the fork provides the methods rsa3072_ and p256_, which combine with RSA3072 and with ECDSA using NIST's P256 curve respectively.
If right, we might document "L2" for dilithium2 but without any implications as to any code operations (incl. the classic algs used in hybrid).
Officially, level 2 means computational resources equivalent to a collision search on a 256-bit hash function such as SHA-256. For a single bit-security metric level 1 and 2 both have 128 bit security, although a more granular resource estimate would view level 2 as having a higher resource requirement than level 1. For our purposes, it is fine to continue viewing level 2 as 128-bit security and pairing it with AES128 and SHA256 / SHA3-256.