open-quantum-safe/openssl

Dilithium2 incorrectly marked as level 1

dstebila opened this issue · 2 comments

The issue stems from

def nist_to_bits(nistlevel):
if nistlevel==1 or nistlevel==2:
return 128
elif nistlevel==3 or nistlevel==4:
return 192
elif nistlevel==5:
return 256
else:
return None
treating both NIST L1 and L2 as "128 bits security". Is this right or wrong? If wrong, the documentation regarding hybrids must be changed, too:

if claims NIST L1 or L2 security, then the fork provides the methods rsa3072_ and p256_, which combine with RSA3072 and with ECDSA using NIST's P256 curve respectively.

If right, we might document "L2" for dilithium2 but without any implications as to any code operations (incl. the classic algs used in hybrid).

Officially, level 2 means computational resources equivalent to a collision search on a 256-bit hash function such as SHA-256. For a single bit-security metric level 1 and 2 both have 128 bit security, although a more granular resource estimate would view level 2 as having a higher resource requirement than level 1. For our purposes, it is fine to continue viewing level 2 as 128-bit security and pairing it with AES128 and SHA256 / SHA3-256.