[CFRG] Request for adoption: Signature modes guidance / draft-harvey-cfrg-mtl-mode-03

["Kaliski, Burt" <[e-mail]>]

CFRG,

Following up on my presentation at IETF 120, I would like to request that CFRG adopt draft-harvey-cfrg-mtl-mode-03 [1] as part of a broader research effort to provide guidance on modes of operation for digital signature schemes in applications.  The authors' rationale is as follows:

* NIST is in the process of standardizing what are effectively two modes of operation for FIPS 204 and 205 - "pure signing" where the message is signed directly with the underlying signature scheme and "pre-hash signing" where the hash of the message is signed.  NIST has also introduced a "domain separator" format to distinguish the two modes [2].  (draft-harvey-cfrg-mtl-mode-03 adopts the domain separator format to distinguish MTL mode from others.)

* There are discussions underway on these topics on NIST's pqc-forum mailing list [3].  It seems prudent that CFRG advance guidance to applications on how and when to use pure signing vs. pre-hash signing, how to use domain separators and context strings in inputs to signature schemes, and how to approach other modes of operation.

* The initial use case for MTL mode is DNSSEC, as described in draft-fregly-dnsop-slh-dsa-mtl-dnssec-02 [4].  The current draft includes an example zone file signed with SPHINCS+ (SLH-DSA) in MTL mode.  The authors hosted a hackathon session [5] on the draft at IETF 120 and also presented [6] at HotRFC.  In addition, following the PQ DNSSEC side meeting [7], a new non-WG mailing list, pq-dnssec [8], was formed in the Security Area.  The mailing list will be used for discussions of draft-fregly-research-agenda-for-pqc-dnssec-01 [9].  MTL mode is one of several approaches for reducing the operational impact of post-quantum signatures identified in the draft.

* Another example of a signature mode where CFRG guidance would be helpful is composite signatures [10].  For instance, if the composite signature construction is applied to FIPS 204/205, does this mean that FIPS 204/205 is operated in "pure" mode (because the pre-hashing has already been done)?  And how should an application use the optional context string provided by FIPS 204/205 in a composite construction?

* Verisign announced a public, royalty-free license to certain intellectual property related to draft-harvey-cfrg-mtl-mode-03.  IPR declarations 6174-6176 [11] give the official language.

Thanks -- Burt
 
[1] J. Harvey, B. Kaliski, A. Fregly, S. Sheth.  Merkle Tree Ladder (MTL) Mode Signatures.  draft-harvey-cfrg-mtl-mode-03, June 12, 2024, https://datatracker.ietf.org/doc/draft-harvey-cfrg-mtl-mode/03/
[2] D. Moody. Updates on pre-hash for FIPS 204 and 205. [e-mail] mailing list, April 19, 2024, https://groups.google.com/a/list.nist.gov/g/pqc-forum/c/JKMh0D0pa30/m/vbflXolxAQAJ. 
[3] pqc-forum mailing list, https://groups.google.com/a/list.nist.gov/g/pqc-forum
[4] A.M. Fregly, B. Kaliski. J. Harvey, D. Wessels.  Stateless Hash-Based Signatures in Merkle Tree Ladder Mode (SLH-DSA-MTL) for DNSSEC.  draft-fregly-dnsop-slh-dsa-mtl-dnssec-02, July 8, 2024, https://datatracker.ietf.org/doc/draft-fregly-dnsop-slh-dsa-mtl-dnssec/02/
[5] Exploring Implementation Approaches for Merkle Tree Ladder Mode Signatures for DNSSEC, IETF 120 Hackathon, https://wiki.ietf.org/en/meeting/120/hackathon
[6] A. Fregly, Stateless Hash-Based Signatures in Merkle Tree Ladder Mode (SLH-DSA-MTL) for DNSSEC, IETF 120 HotRFC, https://datatracker.ietf.org/meeting/120/materials/slides-120-hotrfc-sessa-04-stateless-hash-based-signatures-in-merkle-tree-ladder-mode-01
[7] Side Meetings at IETF 120, https://wiki.ietf.org/en/meeting/120/sidemeetings
[8] pq-dnssec mailing list, https://mailarchive.ietf.org/arch/browse/pq-dnssec/
[9] A.M. Fregly et al., Research Agenda for a Post-Quantum DNSSEC.  draft-fregly-research-agenda-for-pqc-dnssec-01, June 26, 2024, https://datatracker.ietf.org/doc/draft-fregly-research-agenda-for-pqc-dnssec/01/
[10] M. Ounsworth et al., Composite ML-KEM for Use in the Internet X.509 Public Key Infrastructure and CMS.  draft-ietf-lamps-pq-composite-kem-04, July 8, 2024, https://datatracker.ietf.org/doc/draft-ietf-lamps-pq-composite-kem/04/
[11] https://datatracker.ietf.org/ipr/search/?draft=draft-harvey-cfrg-mtl-mode&rfc=&doctitle=&group=&holder=VeriSign%2C+Inc.&iprtitle=&patent=&submit=draft