XPost: linux.debian.devel
Andreas Metzler <
[email protected]> writes:
On 2025-07-25 Simon Josefsson <[email protected]> wrote:
Andreas Metzler <[email protected]> writes:
[...]
* I doubt that a multi-year old version of liboqs (which is what you'd
have in stable in a not too distant future) would be useful for
experiments and testing. liboqs is pretty fast moving. You would want
bleeding edge for experimenting.
My primary use-case for liboqs in stable is to setup interop testing
between different PQ libraries and help development of PQ libraries.
Having some OLD and stable release of liboqs widely available is what I
would prefer. I want to test that some other PQ crypto libraries are
able to interop with some old known-to-produce-correct-results liboqs.
So there is no need for this liboqs to be able to protect sensitive
data. It just have to produce something. Which seems to match what the
liboqs maintainers says it is good for.
Hello,
If there is a stable release of liboqs this indeed makes sense.
In what way are the liboqs releases less stable than many other things
we accept into stable? The limitation seems to be:
WE DO NOT CURRENTLY RECOMMEND RELYING ON THIS LIBRARY IN A
PRODUCTION ENVIRONMENT OR TO PROTECT ANY SENSITIVE DATA. This
library is meant to help with research and prototyping. While we
make a best-effort approach to avoid security bugs, this library has
not received the level of auditing and analysis that would be
necessary to rely on it for high security use.
There are other things in stable with similar properties, which many
find useful because their field of interest is research and prototyping.
/Simon
-----BEGIN PGP SIGNATURE-----
iQNoBAEWCAMQFiEEo8ychwudMQq61M8vUXIrCP5HRaIFAmiEiMgUHHNpbW9uQGpv c2Vmc3Nvbi5vcmfCHCYAmDMEXJLOtBYJKwYBBAHaRw8BAQdACIcrZIvhrxDBkK9f V+QlTmXxo2naObDuGtw58YaxlOu0JVNpbW9uIEpvc2Vmc3NvbiA8c2ltb25Aam9z ZWZzc29uLm9yZz6IlgQTFggAPgIbAwULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgBYh BLHSvRN1vst4TPT4xNc89jjFPAa+BQJn0XQkBQkNZGbwAAoJENc89jjFPAa+BtIA /iR73CfBurG9y8pASh3cbGOMHpDZfMAtosu6jbpO69GHAP4p7l57d+iVty2VQMsx +3TCSAvZkpr4P/FuTzZ8JZe8BrgzBFySz4EWCSsGAQQB2kcPAQEHQOxTCIOaeXAx I2hIX4HK9bQTpNVei708oNr1Klm8qCGKiPUEGBYIACYCGwIWIQSx0r0Tdb7LeEz0 +MTXPPY4xTwGvgUCZ9F0SgUJDWRmSQCBdiAEGRYIAB0WIQSjzJyHC50xCrrUzy9R cisI/kdFogUCXJLPgQAKCRBRcisI/kdFoqdMAQCgH45aseZgIrwKOvUOA9QfsmeE 8GZHYNuFHmM9FEQS6AD6A4x5aYvoY6lo98pgtw2HPDhmcCXFItjXCrV4A0GmJA4J ENc89jjFPAa+wUUBAO64fbZek6FPlRK0DrlWsrjCXuLi6PUxyzCAY6lG2nhUAQC6 qobB9mkZlZ0qihy1x4JRtflqFcqqT9n7iUZkCDIiDbg4BFySz2oSCisGAQQBl1UB BQEBB0AxlRumDW6nZY7A+VCfek9VpEx6PJmdJyYPt3lNHMd6HAMBCAeIfgQYFggA JgIbDBYhBLHSvRN1vst4TPT4xNc89jjFPAa+BQJn0XTSBQkNZGboAAoJENc89jjF PAa+0M0BAPPRq73kLnHYNDMniVBOzUdi2XeF32idjEWWfjvyIJUOAP4wZ+ALxIeh is3Uw2BzGZE6ttXQ2Q+DeCJO3TPpIqaXDAAKCRBRcisI/kdFogUrAP4o1WaT0ZmO 9gTwFKglU1aILT5Jjzj+6m2dJ3nGGS4qMAD/cIu9B8UgpfmyCaovKY5h0xTzX7aq RAFEdAg0dHRB3wU=
=NLeF
-----END PGP SIGNATURE-----
--- SoupGate-Win32 v1.05
* Origin: fsxNet Usenet Gateway (21:1/5)