[CFRG] Re: Request for adoption: Signature modes guidance / draft-harvey-cfrg-mtl-mode-03

[Russ Housley <[e-mail]>]

I would like to see the CFRG publish an algorithm description for MTL mode.  People have been experimenting with it at the IETF Hackathon, and that may lead to some very helpful information about where the MTL mode is advantageous.  Also, these developers are aware of the license, and they still were willing to donate their time to experiment.  

Russ


> On Aug 5, 2024, at 9:42 AM, Kaliski, Burt <bkaliski=[e-mail]> wrote:
> 
> CFRG,
> 
> Following up on my presentation at IETF 120, I would like to request that CFRG adopt draft-harvey-cfrg-mtl-mode-03 [1] as part of a broader research effort to provide guidance on modes of operation for digital signature schemes in applications.  The authors' rationale is as follows:
> 
> * NIST is in the process of standardizing what are effectively two modes of operation for FIPS 204 and 205 - "pure signing" where the message is signed directly with the underlying signature scheme and "pre-hash signing" where the hash of the message is signed.  NIST has also introduced a "domain separator" format to distinguish the two modes [2].  (draft-harvey-cfrg-mtl-mode-03 adopts the domain separator format to distinguish MTL mode from others.)
> 
> * There are discussions underway on these topics on NIST's pqc-forum mailing list [3].  It seems prudent that CFRG advance guidance to applications on how and when to use pure signing vs. pre-hash signing, how to use domain separators and context strings in inputs to signature schemes, and how to approach other modes of operation.
> 
> * The initial use case for MTL mode is DNSSEC, as described in draft-fregly-dnsop-slh-dsa-mtl-dnssec-02 [4].  The current draft includes an example zone file signed with SPHINCS+ (SLH-DSA) in MTL mode.  The authors hosted a hackathon session [5] on the draft at IETF 120 and also presented [6] at HotRFC.  In addition, following the PQ DNSSEC side meeting [7], a new non-WG mailing list, pq-dnssec [8], was formed in the Security Area.  The mailing list will be used for discussions of draft-fregly-research-agenda-for-pqc-dnssec-01 [9].  MTL mode is one of several approaches for reducing the operational impact of post-quantum signatures identified in the draft.
> 
> * Another example of a signature mode where CFRG guidance would be helpful is composite signatures [10].  For instance, if the composite signature construction is applied to FIPS 204/205, does this mean that FIPS 204/205 is operated in "pure" mode (because the pre-hashing has already been done)?  And how should an application use the optional context string provided by FIPS 204/205 in a composite construction?
> 
> * Verisign announced a public, royalty-free license to certain intellectual property related to draft-harvey-cfrg-mtl-mode-03.  IPR declarations 6174-6176 [11] give the official language.
> 
> Thanks -- Burt
> 
> [1] J. Harvey, B. Kaliski, A. Fregly, S. Sheth.  Merkle Tree Ladder (MTL) Mode Signatures.  draft-harvey-cfrg-mtl-mode-03, June 12, 2024, https://datatracker.ietf.org/doc/draft-harvey-cfrg-mtl-mode/03/
> [2] D. Moody. Updates on pre-hash for FIPS 204 and 205. [e-mail] mailing list, April 19, 2024, https://groups.google.com/a/list.nist.gov/g/pqc-forum/c/JKMh0D0pa30/m/vbflXolxAQAJ. 
> [3] pqc-forum mailing list, https://groups.google.com/a/list.nist.gov/g/pqc-forum
> [4] A.M. Fregly, B. Kaliski. J. Harvey, D. Wessels.  Stateless Hash-Based Signatures in Merkle Tree Ladder Mode (SLH-DSA-MTL) for DNSSEC.  draft-fregly-dnsop-slh-dsa-mtl-dnssec-02, July 8, 2024, https://datatracker.ietf.org/doc/draft-fregly-dnsop-slh-dsa-mtl-dnssec/02/
> [5] Exploring Implementation Approaches for Merkle Tree Ladder Mode Signatures for DNSSEC, IETF 120 Hackathon, https://wiki.ietf.org/en/meeting/120/hackathon
> [6] A. Fregly, Stateless Hash-Based Signatures in Merkle Tree Ladder Mode (SLH-DSA-MTL) for DNSSEC, IETF 120 HotRFC, https://datatracker.ietf.org/meeting/120/materials/slides-120-hotrfc-sessa-04-stateless-hash-based-signatures-in-merkle-tree-ladder-mode-01
> [7] Side Meetings at IETF 120, https://wiki.ietf.org/en/meeting/120/sidemeetings
> [8] pq-dnssec mailing list, https://mailarchive.ietf.org/arch/browse/pq-dnssec/
> [9] A.M. Fregly et al., Research Agenda for a Post-Quantum DNSSEC.  draft-fregly-research-agenda-for-pqc-dnssec-01, June 26, 2024, https://datatracker.ietf.org/doc/draft-fregly-research-agenda-for-pqc-dnssec/01/
> [10] M. Ounsworth et al., Composite ML-KEM for Use in the Internet X.509 Public Key Infrastructure and CMS.  draft-ietf-lamps-pq-composite-kem-04, July 8, 2024, https://datatracker.ietf.org/doc/draft-ietf-lamps-pq-composite-kem/04/
> [11] https://datatracker.ietf.org/ipr/search/?draft=draft-harvey-cfrg-mtl-mode&rfc=&doctitle=&group=&holder=VeriSign%2C+Inc.&iprtitle=&patent=&submit=draft
> 
> _______________________________________________
> CFRG mailing list -- [e-mail]
> To unsubscribe send an email to [e-mail]