Re: [CFRG] NSA vs. hybrid

[Jeff Burdges <[e-mail]>]

I agree with Dan here..  

It should become standard best practices that certificates for relatively young unproven primitives pair them with older proven primitives, and specify a correct hybrid protocol.  There exist exceptions of course, like protocols that intentionally tolerate a lower security level, but default best practice should be exactly what Dan describes.

It’s always possible logic bugs arise in validation code of course, but test vectors can trivially catch these bugs, assuming the certificate format specifies both key types and the hybrid protocol.  

It’s fairly clear separate P and Q certificate chains obstruct test vectors from enforcing this and invite more opportunities for downgrade attacks, etc. too.

It’s all trickier if you want the extreme algorithm agility of TLS of course, but not any harder than making separate P and Q certificate chains work correctly.  

Best,
Jeff