rUv
40e5a4d6f2
Closes the quantum-resistance gap explicitly deferred from ADR-107. Final ADR in the privacy + federation chain. Replaces DH key exchange in ADR-107's Layer 4 secure aggregation with Kyber-768 KEM (NIST FIPS 203, CNSA 2.0 default). Migration timeline: - Phase 0 (NOW 2026): Classical X25519 (ADR-107 default) - Phase 1 (2026-Q4 -> 2027): Kyber-768 opt-in via --enable-pqc flag - Phase 2 (2027-Q2 -> 2028): Hybrid (X25519 + Kyber-768) becomes default - Phase 3 (2030+): Pure Kyber-768 (classical retired) Why hybrid for Phase 2 (belt-and-braces): - Protects against future Kyber breaks (Kyber is ~5 years old) - Protects against classical breaks (X25519 backup) - Protects against implementation bugs in either primitive - Cost: ~3 kB/round/installation extra (negligible) Why now (record-now-decrypt-later): Adversaries can record federated updates today and decrypt them in 2035 when quantum capabilities arrive. Without ADR-108, the (epsilon, delta) guarantees of ADR-106 silently expire when quantum computers arrive. Proactive migration is cheap insurance. Why Kyber-768 (not 512 or 1024): - NIST FIPS 203 (2024); ~AES-192 equivalent - CNSA 2.0 recommended default - Used by Cloudflare, Google, AWS in 2024-2026 rollouts - Public key 1184 B, ciphertext 1088 B, secret 32 B - 512 lacks CNSA 2.0 sign-off; 1024 doubles bandwidth without benefit LOC: +220 on top of ADR-107. Total federation budget ADR-105+106+107+108: ~1,550 LOC. Threat model: 8 threats, every row has mitigation. Hybrid mode is the belt-and-braces against both Kyber breaks AND classical breaks. ADR CHAIN COMPLETE: 7 ADRs in the privacy + federation chain: ADR-100 (cog packaging) -> ADR-103 (cog example) -> ADR-104 (MCP/CLI) -> ADR-105 (within-installation federation) -> ADR-106 (DP + isolation) -> ADR-107 (cross-installation + SA) -> ADR-108 (PQC key exchange). No remaining unspecified privacy gap at any threat horizon (classical or quantum). Future ADRs catalogued: - ADR-109: PQC signatures (Dilithium replaces Ed25519 in ADR-100) - ADR-110: PQC hardware acceleration on Cognitum-v0 - ADR-111: PQC for cog-store distribution Composes: - R3 / R14 / R15 / R7 / R12 PABS: privacy chain intact through quantum transition - R10 / R11 (long-deployment): benefit most from forward secrecy as data ages Honest scope: - Kyber ~5 years old; hybrid mitigates uncertainty - 'When do we need this?' uncertain (2030 aggressive / 2050+ conservative) - ESP32-S3 timing ~10 ms per handshake estimated negligible; needs measurement - Phase 3 retirement of classical needs future decision Coordination: ticks/tick-28.md, no PROGRESS.md edit.
3.3 KiB
Tick 28 — 2026-05-22 09:40 UTC
Thread: ADR-108 (Kyber post-quantum key exchange) Verdict: Final ADR in the privacy + federation chain. Closes the quantum-resistance gap deferred from ADR-107. Hybrid mode (Kyber-768 + X25519) for 2027-2030 migration; pure Kyber-768 for Phase 3.
What shipped
docs/adr/ADR-108-kyber-post-quantum-key-exchange.md— full ADR draft.
Headline
| Phase | Timeline | Cryptography |
|---|---|---|
| Phase 0 | NOW (2026) | Classical X25519 (ADR-107 default) |
| Phase 1 | 2026-Q4 → 2027 | Kyber-768 opt-in via --enable-pqc |
| Phase 2 | 2027-Q2 → 2028 | Hybrid (X25519 + Kyber-768) becomes default |
| Phase 3 | 2030+ | Pure Kyber-768 (classical retired) |
Why Kyber-768: NIST FIPS 203 (2024); ~AES-192 equivalent; CNSA 2.0 default; used by Cloudflare/Google/AWS in 2024-2026 rollouts.
Why hybrid for Phase 2: belt-and-braces against future Kyber breaks (Kyber is ~5 years old) OR classical breaks OR implementation bugs in either primitive.
Why now (the record-now-decrypt-later argument)
Adversaries can record federated updates today and decrypt them in 2035 when quantum capabilities arrive. Without ADR-108, the (ε, δ) guarantees of ADR-106 silently expire when quantum computers arrive.
Bandwidth + LOC budgets
Bandwidth: ~3 kB/round/installation extra during hybrid mode (negligible).
LOC: +220 on top of ADR-107.
Total federation budget across ADR-105+106+107+108: ~1,550 LOC.
ADR chain closes
Final ADR in the privacy + federation chain:
| # | ADR | What it closes |
|---|---|---|
| 1 | ADR-100 | cog packaging (foundation) |
| 2 | ADR-103 | first cog example (cog-person-count) |
| 3 | ADR-104 | MCP + CLI distribution |
| 4 | ADR-105 | within-installation federation |
| 5 | ADR-106 | DP-SGD + biometric primitive isolation |
| 6 | ADR-107 | cross-installation + secure aggregation |
| 7 | ADR-108 | post-quantum key exchange |
No remaining unspecified privacy gap at any threat horizon (classical OR quantum).
Composes with prior threads
- R3 / R14 / R15 / R7 / R12 PABS — privacy chain intact through quantum transition
- R10 / R11 (long-deployment wildlife / maritime) — benefit most from forward secrecy because data ages for years
Honest scope
- Kyber is ~5 years old (less battle-tested than X25519); hybrid mode mitigates
- "When do we need this?" is uncertain (2030 aggressive / 2050+ conservative); proactive migration is cheap insurance
- ESP32-S3 timing impact (~10 ms per handshake) estimated negligible vs 30 s round duration; needs benchmarking
- Migration timeline depends on
pqcrypto-kyberRust crate maturity - Phase 3 retirement of classical needs future decision
Future ADRs catalogued
- ADR-109: PQC signatures (Dilithium for cog signing, replaces Ed25519 in ADR-100)
- ADR-110: PQC hardware acceleration on Cognitum-v0 if timing becomes binding
- ADR-111: PQC for
cog-storedistribution chain
Coordination
ticks/tick-28.md. No PROGRESS.md edit. Branch research/sota-adr108-kyber.
Remaining loop work
- R12.1: pose-PABS closed loop (needs Rust, out of scope for synthetic ticks)
- Loop retrospective / 00-summary.md (~2.3h until cron stop — premature)
~2.3h to cron stop. 28 ticks landed. 4 ADRs in the privacy chain (105/106/107/108). Loop covers everything except R12.1 implementation.