Draft: draft-ietf-emu-aka-pfs-latest

Commentary:  : The PQ considerations are quite generic and does not really say anything about the security properties of this specific protocol ( it even mentions constrained IoT ) . For example , it could instead talk about specifics of this protocol , e.g. , Secrecy : the CK'/IK ' goes into the derivation of the output keys , so even if a PQ adversary can compute the joint DH - key , then I assume only the FS property gets broken ( possibly ) . The adversary would still not be able to break the symmetric key parts , so the established key would still be secret , right ? Authentication : By the same argument : if symmetric key crypto would still be safe PQ , then the adversary wo n't be able to disrupt authentication and do impersonation attacks , I assume . 
 I like your angle on PQ . We need exact text though . 
 This sounds like good changes
As of the publication of this specification, it is unclear when or
even if a quantum computer of sufficient size and power to exploit
elliptic curve cryptography will exist.  Deployments that need to
consider risks decades into the future should transition to Post-
Quantum Cryptography (PQC) in the not-too-distant future.  Many other
systems should take a slower wait-and-see approach where PQC is
phased in when the quantum threat is more imminent.  Current PQC
algorithms have limitations compared to Elliptic Curve Cryptography
(ECC) and the data sizes would be problematic in many constrained IoT
systems.  If a Cryptographically Relevant Quantum Computer (CRQC) is
built it could recover the SHARED_SECRET from the ECDHE public keys
in a matter of hours.
As of the publication of this specification, it is unclear when or
even if a quantum computer of sufficient size and power to exploit
elliptic curve cryptography will exist.  Deployments that need to
consider risks decades into the future should transition to Post-
Quantum Cryptography (PQC) in the not-too-distant future.  Other
systems may employ PQC when the quantum threat is more imminent.
Current PQC algorithms have limitations compared to Elliptic Curve
Cryptography (ECC) and the data sizes could be problematic for some
constrained systems.  If a Cryptographically Relevant Quantum
Computer (CRQC) is built it could recover the SHARED_SECRET from the
ECDHE public keys.
This would not affect the ability of EAP-AKA' (with or without this
extension) to authenticate properly, however.  As symmetric key
cryptography is safe even if CRQCs are built, an adversary still will
not be able to disrupt authentication as it requires computing a
correct AT_MAC value.  This computation requires the K_aut key which
is based on MK and, ultimately, CK' and IK', but not SHARED_SECRET.
Other output keys do include SHARED_SECRET via MK_ECDHE, but still
include also CK' and IK' which are entirely based on symmetricy
cryptography.  As a result, an adversary with a quantum computer
still cannot compute the other output keys either.
However, if the adversary has also obtained knowledge of the secrets
associated with the SIM card, they could then compute CK', IK', and
SHARED_SECRET, and any derived output keys.  This means that the the
introduction of a powerful enough quantum computer would enable
subverting this protocol extension, making it necessary to update the
current ECC algorithms in this specification to PQC algorithms.  This
specification does not add such algorithms, but a future
specification may do that.