Remove GMP dependency

[cryptoquick]

Hi, I'm looking to use SQIsign in Rust. I asked the maintainer of rustpq if they would be interested in including it, and they mentioned here that they won't merge any implementation with a GMP dependency:

rustpq/pqcrypto#65 (comment)

How difficult would this be to do?

[defeo]

a lot

[defeo]

Getting rid of GMP is a very low priority goal for SQIsign.

I should also point out that the SQIsign reference implementation is what the name indicates: an implementation for reference and absolutely not production-ready.

[cryptoquick]

Okay, thanks for the quick response. I'll close this for now, so you can reopen if it ever comes up again.

I don't suppose you can give me a sense for any updates on standardization or review?

[defeo]

NIST has indicated they intend to finalize the current round for additional signatures before the end of the year. Assuming that SQIsign passes the selection, we may do some tweaks to the specification, reflecting NIST's comments. So you may expect a new version by spring 2025, but no date is official.

Speaking for myself, I have the impression that NIST is in no rush to standardize additional signatures, so you may have to wait several years before SQIsign becomes a standard.

[cryptoquick]

Thank you for the update!