Although NIST rejected a prior ROLLO-I-128 implementation proposal, there is a possibility they will consider new rank-based implementations exploiting similar techniques as in ROLLO-I-128 as part of a future call for proposals for new cryptographic signature schemes. And even if it does not become part of the official NIST standard, a robust implementation could still provide value for commercial security tools.
For example, one of the potential advantages of ROLLO-I-128 is that it is relatively fast at key encapsulation, which is one important step of key encapsulation schemes. The two other steps are key generation and key decapsulation. This could demonstrate benefits in applications where a larger number of low-powered devices need to share secrets, by “encapsulating” them, with a more powerful server that will then decapsulate the secrets that will be used to establish secure symmetric encryption.
