Content-Type: text/plain;
	charset=us-ascii
Mime-Version: 1.0 (Mac OS X Mail 16.0 \(3731.700.6.1.1\))
From: Russ Housley <housley@vigilsec.com>
In-Reply-To: <43f8434f68c144f38b4a4a3933841899@verisign.com>
Date: Wed, 7 Aug 2024 17:15:34 -0400
Content-Transfer-Encoding: quoted-printable
Message-Id: <C4016C7F-3830-4C78-A4C6-1E41A4BA4C5D@vigilsec.com>
References: <43f8434f68c144f38b4a4a3933841899@verisign.com>
To: "Kaliski, Burt" <bkaliski=40verisign.com@dmarc.ietf.org>
Message-ID-Hash: Q7U3ECHS6BH7O5CCSCQGDD67JK3BAWIA
CC: IRTF CFRG <cfrg@irtf.org>, "Sheth, Swapneel" <ssheth@Verisign.com>
Precedence: list
Subject: =?utf-8?q?=5BCFRG=5D_Re=3A_Request_for_adoption=3A__Signature_modes_guidance?=
 =?utf-8?q?_/_draft-harvey-cfrg-mtl-mode-03?=
Archived-At: 
 <https://mailarchive.ietf.org/arch/msg/cfrg/F5WRgtRJmNwLGYaEWgjJSDMcTj8>

I would like to see the CFRG publish an algorithm description for MTL =
mode.  People have been experimenting with it at the IETF Hackathon, and =
that may lead to some very helpful information about where the MTL mode =
is advantageous.  Also, these developers are aware of the license, and =
they still were willing to donate their time to experiment. =20

Russ


> On Aug 5, 2024, at 9:42 AM, Kaliski, Burt =
<bkaliski=3D40verisign.com@dmarc.ietf.org> wrote:
>=20
> CFRG,
>=20
> Following up on my presentation at IETF 120, I would like to request =
that CFRG adopt draft-harvey-cfrg-mtl-mode-03 [1] as part of a broader =
research effort to provide guidance on modes of operation for digital =
signature schemes in applications.  The authors' rationale is as =
follows:
>=20
> * NIST is in the process of standardizing what are effectively two =
modes of operation for FIPS 204 and 205 - "pure signing" where the =
message is signed directly with the underlying signature scheme and =
"pre-hash signing" where the hash of the message is signed.  NIST has =
also introduced a "domain separator" format to distinguish the two modes =
[2].  (draft-harvey-cfrg-mtl-mode-03 adopts the domain separator format =
to distinguish MTL mode from others.)
>=20
> * There are discussions underway on these topics on NIST's pqc-forum =
mailing list [3].  It seems prudent that CFRG advance guidance to =
applications on how and when to use pure signing vs. pre-hash signing, =
how to use domain separators and context strings in inputs to signature =
schemes, and how to approach other modes of operation.
>=20
> * The initial use case for MTL mode is DNSSEC, as described in =
draft-fregly-dnsop-slh-dsa-mtl-dnssec-02 [4].  The current draft =
includes an example zone file signed with SPHINCS+ (SLH-DSA) in MTL =
mode.  The authors hosted a hackathon session [5] on the draft at IETF =
120 and also presented [6] at HotRFC.  In addition, following the PQ =
DNSSEC side meeting [7], a new non-WG mailing list, pq-dnssec [8], was =
formed in the Security Area.  The mailing list will be used for =
discussions of draft-fregly-research-agenda-for-pqc-dnssec-01 [9].  MTL =
mode is one of several approaches for reducing the operational impact of =
post-quantum signatures identified in the draft.
>=20
> * Another example of a signature mode where CFRG guidance would be =
helpful is composite signatures [10].  For instance, if the composite =
signature construction is applied to FIPS 204/205, does this mean that =
FIPS 204/205 is operated in "pure" mode (because the pre-hashing has =
already been done)?  And how should an application use the optional =
context string provided by FIPS 204/205 in a composite construction?
>=20
> * Verisign announced a public, royalty-free license to certain =
intellectual property related to draft-harvey-cfrg-mtl-mode-03.  IPR =
declarations 6174-6176 [11] give the official language.
>=20
> Thanks -- Burt
>=20
> [1] J. Harvey, B. Kaliski, A. Fregly, S. Sheth.  Merkle Tree Ladder =
(MTL) Mode Signatures.  draft-harvey-cfrg-mtl-mode-03, June 12, 2024, =
https://datatracker.ietf.org/doc/draft-harvey-cfrg-mtl-mode/03/
> [2] D. Moody. Updates on pre-hash for FIPS 204 and 205. =
pqc-forum@list.nist.gov mailing list, April 19, 2024, =
https://groups.google.com/a/list.nist.gov/g/pqc-forum/c/JKMh0D0pa30/m/vbfl=
XolxAQAJ.=20
> [3] pqc-forum mailing list, =
https://groups.google.com/a/list.nist.gov/g/pqc-forum
> [4] A.M. Fregly, B. Kaliski. J. Harvey, D. Wessels.  Stateless =
Hash-Based Signatures in Merkle Tree Ladder Mode (SLH-DSA-MTL) for =
DNSSEC.  draft-fregly-dnsop-slh-dsa-mtl-dnssec-02, July 8, 2024, =
https://datatracker.ietf.org/doc/draft-fregly-dnsop-slh-dsa-mtl-dnssec/02/=

> [5] Exploring Implementation Approaches for Merkle Tree Ladder Mode =
Signatures for DNSSEC, IETF 120 Hackathon, =
https://wiki.ietf.org/en/meeting/120/hackathon
> [6] A. Fregly, Stateless Hash-Based Signatures in Merkle Tree Ladder =
Mode (SLH-DSA-MTL) for DNSSEC, IETF 120 HotRFC, =
https://datatracker.ietf.org/meeting/120/materials/slides-120-hotrfc-sessa=
-04-stateless-hash-based-signatures-in-merkle-tree-ladder-mode-01
> [7] Side Meetings at IETF 120, =
https://wiki.ietf.org/en/meeting/120/sidemeetings
> [8] pq-dnssec mailing list, =
https://mailarchive.ietf.org/arch/browse/pq-dnssec/
> [9] A.M. Fregly et al., Research Agenda for a Post-Quantum DNSSEC.  =
draft-fregly-research-agenda-for-pqc-dnssec-01, June 26, 2024, =
https://datatracker.ietf.org/doc/draft-fregly-research-agenda-for-pqc-dnss=
ec/01/
> [10] M. Ounsworth et al., Composite ML-KEM for Use in the Internet =
X.509 Public Key Infrastructure and CMS.  =
draft-ietf-lamps-pq-composite-kem-04, July 8, 2024, =
https://datatracker.ietf.org/doc/draft-ietf-lamps-pq-composite-kem/04/
> [11] =
https://datatracker.ietf.org/ipr/search/?draft=3Ddraft-harvey-cfrg-mtl-mod=
e&rfc=3D&doctitle=3D&group=3D&holder=3DVeriSign%2C+Inc.&iprtitle=3D&patent=
=3D&submit=3Ddraft
>=20
> _______________________________________________
> CFRG mailing list -- cfrg@irtf.org
> To unsubscribe send an email to cfrg-leave@irtf.org