Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It only takes a minute to sign up.
Sign up to join this community
I have seen in many papers and even in communications from NIST that the ongoing standardization is a "procedure" or a "process". They carefully refrain from using the term competition like AES. I was wondering what is the reason for this? Is there any functional difference on how this process is conducted?
Thanks in advance.
Is there any functional difference on how this process is conducted?
One likely difference is the intended end goal. The intended result of the AES process was to approve exactly one proposal, and that is what they did. In contrast, they are likely to approve at least two proposals (both for kem/public key encryption, and the signature side of things, so that is at least four approved algorithms).
There are likely several reasons for this; for one, all the AES candidates did basically the same thing; hence it wouldn't make sense to approve multiple. In contrast there are some significantly trade-offs between the PQC algorithms; for example, Rainbow has quite small signatures (and huge public keys), while Falcon/Dilithium have (by PQ standards) moderate signatures and moderate public keys. Which is more appropriate is likely to vary by use case.
The other reason is trust. When the AES competition happened, there was a fairly good understanding of block ciphers (as we had been examining them for over 20 years); in contrast, we have comparatively less understanding of some of these postquantum algorithms (especially against attacks by Quantum Computers); hence it makes sense to approve several (so that if one is broken by a new discovery, we have a backup).
Now, I'm not NIST, and so these are just my observations; I do believe that I had heard this logic by some speaker from NIST in the past.
I don't know if I can comment authoritatively (I did not notice the difference in verbiage), but the NIST PQC process has been roughly the same format as the AES competition. Namely, an open call for proposals, with candidates being progressively "filtered" out through several (actually three, the same as the AES competition) "rounds" of analysis which each progressively narrow the field, before reaching a selection of several "finalists".
The process has not yet narrowed things down from several finalists -> 1 finalist (as happened with AES). Moreover, things will potentially diverge a bit from the format of the AES competition soon (see discussions about the potential for a round 4 of the competition). But as someone who has been following the competition for a while, I had not noticed practical differences between the standardization process and a "competition" a la AES.
