Re: [Cfrg] I-D Action: draft-irtf-cfrg-xmss-hash-based-signatures-06.txt

On Sat, Jul 23, 2016 at 1:56 PM, Stephen Farrell
<stephen.farrell@cs.tcd.ie> wrote:
>
>
> On 23/07/16 20:14, Paterson, Kenny wrote:
>> Your other point regarding state is well made.
>
> So that, and the fact that implementations are going to be
> brand new and hence quite likely buggy implies to me that
> the more cautious text I suggested takes the right approach.

If we go by that metric, OpenSSL's BN code will never have security
relevant bugs, and ref10. Oh wait, that's not true at all, because we
can verify ref10's correctness, and the BN code actually had bugs.
Maybe we should try solving the problem of writing code to not have
bugs (newsflash: it has been solved, the methods are not expensive,
and crypto is an excellent place to apply them)

We've extremely clearly documented the stateful nature of the scheme.
This implementation question is different from whether the scheme
meets the security goals it claims. We can try to design schemes to
avoid common programing issues, and encourage the usage of more robust
schemes.

>
> Even if we're cryptographically confident of this particular
> scheme, we are IMO far from wanting the Internet to depend
> upon it (or any other proposed PQ scheme).

Isn't this because we aren't sure if we can deploy it safely/the
desirablity ? Do you actually think that XMSS is insecure against
quantum computers? To be clear, if there is no hash function that is
secure against QM, game over: signatures imply hash functions.

Of course, key exchanges are more dangerous then signatures, CA
hoodwinking of customers aside. We don't need to post-quantum
transition signatures now.

>
> Cautious text is better here now, rather than overly optimistic
> text.
>
> S.
>
>
> _______________________________________________
> Cfrg mailing list
> Cfrg@irtf.org
> https://www.irtf.org/mailman/listinfo/cfrg
>

-- 
"Man is born free, but everywhere he is in chains".
--Rousseau.