[VOTE] PQC Capability Tracking Repository Proposal

[AdityaKoranga]

In the last TAC meeting, we discussed a proposal (introduced by Google) to create a centralized, vendor-neutral, crowdsourced repository under PQCA to track PQC capability across cryptographic libraries and common open-source projects.

The goal is to provide a clear, versioned view of PQC readiness -- specifically identifying when cryptographic libraries and open-source projects began supporting PQC. This will help organizations understand which versions they need to adopt in order to leverage PQC capabilities.

During the meeting, we discussed forming a dedicated working group to define the scope, schema, governance, and maintenance of this effort, starting with a focused scope (e.g., cryptographic libraries) and expanding over time.

Dear TAC members, we are now seeking TAC approval to proceed with this initiative. Please indicate your vote below: 👍 Approve / 👎 Reject (comments and feedback are welcome) by the end of this week.

cc @brian-jarvis-aws , @ashman-p , @san-zrl , @mkannwischer @maximilien

[AdityaKoranga]

👍 I approve this, as it will be helpful for the community to have this and will definitely help with the migration process.

[brian-jarvis-aws]

Inclined for the working group approach

[mkannwischer]

Sorry, I missed the last TAC meeting.
Generally, this sounds like a useful working group to me.

I have a couple of questions:

• Is there already a group of people that have shown interest in joining the working group?
• Is it already clear who will be maintaining the repository and lead the working group?
• Do we have a sketch of how the repository will look like?
• Is there any overlap with PQCC's capability heatmap or how is the scope different?

The last two points can be worked out later, but I'm curious if there is already a plan.

[san-zrl]

👍 Ambitious idea. +1 for the working group. Is there overlap with existing activities outside LF?

[ashman-p]

👍 I also approve.
I do wonder if there is a need to organize a little more in terms of identifying leaders, interested members, and initial scope.

[AdityaKoranga]

Sorry, I missed the last TAC meeting. Generally, this sounds like a useful working group to me.

I have a couple of questions:

• Is there already a group of people that have shown interest in joining the working group?

My understanding is that a group of people from Google(the one proposing it) are interested in this and currently the idea is yet not brought into the notice of the wider community to know who else is interested, Once we made this public that WG has been started alongwith the scope then I hope this will bring more people. @aww-aww feel free to add more on this.

• Is it already clear who will be maintaining the repository and lead the working group?

I have some assumptions, so not very clear, I would like to address this in the next TAC meeting.

• Do we have a sketch of how the repository will look like?

@aww-aww provided this https://github.com/aww-aww/pqc-readiness/blob/main/cryptography.md to show the idea for it.

• Is there any overlap with PQCC's capability heatmap or how is the scope different?

PQCC's capability heatmap looks like IETF WG tracking and not the actual library or open source project tracking, so the scope is different.

The last two points can be worked out later, but I'm curious if there is already a plan.

[AdityaKoranga]

👍 I also approve. I do wonder if there is a need to organize a little more in terms of identifying leaders, interested members, and initial scope.

Yes Norm I agree, I will invite Andy in the next TAC meeting to touch up on these points

[AdityaKoranga]

👍 Ambitious idea. +1 for the working group. Is there overlap with existing activities outside LF?

As per my knowledge, there are some activities whose part of the several scopes also include few points in crypto library and which supports PQC but it is very trivial and no where tracks the exact version of when PQC was added or so

[aww-aww]

Thank you for the consideration and comments. We can get into more depth in the TAC session, but to address some of the open questions:

Google is happy to contribute what we have collected, but a cross section of participants is needed to provide neutral coverage that is as detailed as possible. We participate in similar efforts in other realms and have found that establishing github rules to enforce reviews by 2 reviewers from different organizations prior to PR commits provides balance and is not too onerous. Pairing dual review with some presubmit scripts helps make it fairly efficient and low overhead. That said, we're open to any arrangement the TAC approves. It will definitely make sense to provide a pointer to the PQCC heatmap, but the scopes are non-overlapping.

[mkannwischer]

Thanks @aww-aww, @AdityaKoranga for the answers!

Sounds good to me!
👍 for establishing a working group.

[christinaharter]

Hi @AdityaKoranga since this has been approved by the TAC, we can move forward with the next steps. We can discuss more on Wednesday's TAC meeting, but some next steps are:

• Confirm WG Name
• Confirm first members (and a Chair)
• Confirm meeting cadence (meetings open to the public)
• Mailing list and/or Discord channel needed?
• Draft the WG Charter: template here