From: Peter C <Peter.C@ncsc.gov.uk>
To: "cfrg@ietf.org" <cfrg@ietf.org>
Thread-Topic: [CFRG] Re: FW: New Version Notification for
 draft-prabel-cfrg-suf-hybrid-sigs-00.txt
Thread-Index: AQHcQfaVi+rbyDCezUKFzMsh8mordLTN1DDggABrS4CAABWA8A==
Date: Wed, 22 Oct 2025 16:14:15 +0000
Message-ID: 
 <LO2P123MB7051F6171210EE22D51D9ACBBCF3A@LO2P123MB7051.GBRP123.PROD.OUTLOOK.COM>
References: 
 <176097679478.2167493.13960034715954439871@dt-datatracker-84f8f646b-tg6mn>
 <f0104c9096a2464ba6c04275a6f560c5@huawei.com>
 <35f700525b1b8b7743e5829af8f126c6b46fea1f.camel@aisec.fraunhofer.de>
In-Reply-To: 
 <35f700525b1b8b7743e5829af8f126c6b46fea1f.camel@aisec.fraunhofer.de>
Accept-Language: en-GB, en-US
Content-Language: en-US
msip_labels: 
 MSIP_Label_d51697e2-b69a-493f-9635-378990918eab_Enabled=True;MSIP_Label_d51697e2-b69a-493f-9635-378990918eab_SiteId=14aa5744-ece1-474e-a2d7-34f46dda64a1;MSIP_Label_d51697e2-b69a-493f-9635-378990918eab_SetDate=2025-10-22T15:56:40.0000000Z;MSIP_Label_d51697e2-b69a-493f-9635-378990918eab_Name=OFFICIAL
 (No Handling
 Instructions);MSIP_Label_d51697e2-b69a-493f-9635-378990918eab_ContentBits=3;MSIP_Label_d51697e2-b69a-493f-9635-378990918eab_Method=Standard
authentication-results: dkim=none (message not signed)
 header.d=none;dmarc=none action=none header.from=ncsc.gov.uk;
x-ms-publictraffictype: Email
x-ms-traffictypediagnostic: LO2P123MB7051:EE_|CWXP123MB3222:EE_
x-ms-office365-filtering-correlation-id: 9b80f2e3-bca7-4b3f-5bed-08de11860bb7
x-ms-exchange-senderadcheck: 1
x-ms-exchange-antispam-relay: 0
x-microsoft-antispam: 
 BCL:0;ARA:13230040|1800799024|366016|376014|19092799006|7053199007|38070700021;
x-microsoft-antispam-message-info: 
 =?us-ascii?Q?GEj+GBYcofANzVYDZmRyN8jKj8sO/DOjrSWPlDEMY26TV1N8HsVOEvKP+vlC?=
 =?us-ascii?Q?XCbT8UiAAVsE8XiLicgJ5A0SdpfGd4W58NWbvDGJ9se4i5n7lpzfVopuGsKE?=
 =?us-ascii?Q?2wux6hkpcAviQKwrZFkBJ6utcwc+pOmYhF83F8oHz9eWkScbn5qoCw535lna?=
 =?us-ascii?Q?rXu4jt9j1W3WaFKyX7nXMa5G2E7YxrHbLDqREKMC19ZO+gCMY+nEyBZTd86r?=
 =?us-ascii?Q?x65kCMQ0Ex9D+P+YtrfDHI8c68qRweTsZc0rPeSyOZYg23zl7vulchKv60dk?=
 =?us-ascii?Q?5mc2tynM3lDU8kB3FdyqHlkjh4f6rCiTHeRnLifMzk4L5UFOdmvwg9eFmT0I?=
 =?us-ascii?Q?Q6w+15LUNi12IiWA0AFcr/ZTfJavDj7QJhVRmS0NoRhr2dHaOZfo3XW5UrvV?=
 =?us-ascii?Q?LslQnn3dk3swhwfwKl8pFZbIv4qcKfc4z7fcDqmCZ4CMY7W1t9e34OWSrwIy?=
 =?us-ascii?Q?oh1xilQgvu2W2jiTV94ivXASP6XGwqyZfvP0yJD5TsHSBkbiHzalph4N+zYM?=
 =?us-ascii?Q?AccdwHbXLot+0SKIkgClGPSyolkBDJxJBZvjMDvg5VT7FNprLxBSYWq+V8zW?=
 =?us-ascii?Q?tS3+bxCFZHGuAxtG5LNH2vUlSt1yatZIFIoNhe8v9pqo9Ceb7gc4DoXbSDuL?=
 =?us-ascii?Q?6jzdqcg2SbHjLqeu96FXwInrzczCjIJUYqdz/K+PNS7FSWrra2NkaX7vp1tJ?=
 =?us-ascii?Q?f8CXY9DlUZWwwN5vwHhYFzYtTeDn2za2PoWgiTOGVurQv+k8YTfXziMFDvSm?=
 =?us-ascii?Q?JeSIvbv1qUkL48/q7oh3x3Gx2TQUe+j8z/hg7i/Vm4MIfv5kA+q2p1ibLY3r?=
 =?us-ascii?Q?XsM3WFQ+/G5tlprvB4eshTB52rfBe2qWdaHFE22sgGI1QmC0LSX5U5+kGRUm?=
 =?us-ascii?Q?mlhI0nv4c4/a+TgZxlOxzOiJF+KbYzMbdL/hpGJNO4R8tIZdFhl8dNKvsmpB?=
 =?us-ascii?Q?dYwkQvFks+N1ibDsM6gqKIwh+cYo+sWM6AgnyClqkaK2hfZ3Ee+2NRF3Igne?=
 =?us-ascii?Q?hIVdWKGp+Cr++hf6lzsTiyIiz3UNhAKlw7QguiEuBMXWNx4i3nuhOONyYCjp?=
 =?us-ascii?Q?txaFHQdDlcg1juXB+oZsHEzxBMLaR5QrPFHea8sfy3fB7meerbtm0FTxBdij?=
 =?us-ascii?Q?ngxP/jXesL4QDOsuuGxsvyCItQBxkyXZj1T8VRb2vKYtnPqjfWXYcfpezwpQ?=
 =?us-ascii?Q?Lyxr5QNNiGJMKVrJt3xJNeukbnhYXNacqCOcjkq3jW1PI5Om6svtZJkmkL2P?=
 =?us-ascii?Q?Hyre66OHKtyXb2F3L8uWUtZhcqbWVp28czBX0g2b78wN08ztaamjKaR3LuJN?=
 =?us-ascii?Q?g2U5nq45AS1+2nVm3If/FDstsXrv396jDskDeaPkhq+Fg2QtzL3DZNu7eyfk?=
 =?us-ascii?Q?dMUTnwc+mV15tfv8/lZVx5li7wC4r2UXfx5zGN3Xq4WXvadyYBrSBVYtsNnO?=
 =?us-ascii?Q?8V+hCbUd5H97MtPnGUceUZ8MDk3qAnxMvlp18DNd24bwXCdaStieKHE95HV0?=
 =?us-ascii?Q?hER0EVnYfX0ESj5Va7vbINT9ShnScA6orBjd?=
x-forefront-antispam-report: 
 CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:LO2P123MB7051.GBRP123.PROD.OUTLOOK.COM;PTR:;CAT:NONE;SFS:(13230040)(1800799024)(366016)(376014)(19092799006)(7053199007)(38070700021);DIR:OUT;SFP:1101;
x-ms-exchange-antispam-messagedata-chunkcount: 1
x-ms-exchange-antispam-messagedata-0: 
 =?us-ascii?Q?Mge5yXU1txyi+mT2FJg0Lxs94DwqDJXx/BJc80mPSXQGXmb6Bs7yo+HS4uHz?=
 =?us-ascii?Q?nVhSeoWe6B2fZZShlOf++clUxmi5hPWWw8W60ASw/I8o1JZZWrUGlEBD1Iz+?=
 =?us-ascii?Q?jukXlye1WFj8bqW9URmGwoitaOqZ9g1H8AeQbpxeZbGvHZcDDxCpfysJ/rnS?=
 =?us-ascii?Q?BgvtLePvGVN5KKy9nDIoeP0xdeNFs5XH44C/xDCZNGMN1u0keVZXIJqRZTed?=
 =?us-ascii?Q?8mUk+t8RAAiT5S2ND+F2J5Cz1ueRGPA627QxoxZ4DeyQGv0mDzi0L4NvAz9T?=
 =?us-ascii?Q?qr19gESDccjT+/D3jmyY7PR0JZtL0h+2AYAh2A4VO4xptI/0IRqKhOQbn8hV?=
 =?us-ascii?Q?QnvPUwasxTbBOIs76Oi2sFsSjbDYj4nn+yP0C+SYkyv2VdgNNp1Ts6eMuRDS?=
 =?us-ascii?Q?pAFKFDQhFmU11Aauibk/AYJjzhkQ5GivZ4cPYXcYgP36y1SAuPrfm9LLrO8p?=
 =?us-ascii?Q?ZuwOu0WNS6b6F+KXiYkr60fNonZljme+Oh5owMRl25AdftfU9hxO9MlR+JQU?=
 =?us-ascii?Q?eg6N80ZfhEzLKRNDf9NPIS+AsbKzhqefcQ2Wq2xdyecOC+lVHTXiPL4gMeHB?=
 =?us-ascii?Q?ShcaNpfkgb11IzLkc8zCZaVl9Wq/FNngRDuKQZYTlJedKvkem46SpjVKqTy1?=
 =?us-ascii?Q?FnY2n1wr5fMVD0+pTsxW2RaHkLLKGy4wm2QlT20MelR67FugS1lx480bv6Wk?=
 =?us-ascii?Q?qJxiq7MGEFPFYqiTyynD3LVhNNyL5kQGlgUMvFBcyxytNvCraKBePZeNxmGr?=
 =?us-ascii?Q?xfqQBZfvZB4wwYn03jJlBs8iKquY28GVYSOXsX9aJQ0dRcqdW6YE9369gJzf?=
 =?us-ascii?Q?rFOZvos8hp8Rv5sKsJUN5DZ8fM/Hok1r6y+hLG3Z9W6JhjF4i16uutqFcNPd?=
 =?us-ascii?Q?qycdIJ+OCTMy0QidlUI70MaNSJF/X2YwSKIwdCxFYpyauBxdDIOPMPcNhrf7?=
 =?us-ascii?Q?TNf4niLlkDxJJCbPiz+5uCKMsVOrOuKL8SYXyvM7bguTKH9ydSnuerBSxBdy?=
 =?us-ascii?Q?e6Q8Ju1BU+fZ90CG8FyBrGqEMILgFgQMiSOS8WB2YwfbhkuaP3ffdjc0VhNH?=
 =?us-ascii?Q?vYYSg69Ma30wBaacc15cWDPAqzpTCNGjM6kXk2AuNHXSOK+Pk7AqNWygJbYM?=
 =?us-ascii?Q?AeaCQouB+Xn5gkhQOOyGTLRRH02zk/E05V7u5nISqyB5Svajk39inpH4eZeA?=
 =?us-ascii?Q?y/oDg/gvLVFO/2v2n5zOMsoNGHs2kulc8aIwlql9tcnTCHBJEfBa26PcKruG?=
 =?us-ascii?Q?WzQWrwAGp7548N9fTNwllJOBfP0AiNykvHr2nfbB0rcs8kWNKAgvmlyNmjPc?=
 =?us-ascii?Q?l8LgWb1BUCcAO52SyVXQAGI/JNPSxvGGIUT0dKlFjKyC9kkOr78BumtrfzKl?=
 =?us-ascii?Q?Aon7HNno/G6er1gYbSe7ihE4n2rok72fJNIijn08WHMVAxasy9sn2mVPoN9K?=
 =?us-ascii?Q?jyTuX8ct4zuiXSjnHw/MGJRkYOgcvcmj4TVFXVy/zvTch11nL3rMzTzDqcO+?=
 =?us-ascii?Q?xIB1qKlkDdT5FBYL6USoNuRD2hvCUbPYhZVDhiLhc2WrDICkLll28qKmLUIJ?=
 =?us-ascii?Q?OGdt5StpXiQ2b5vLDcFOAIeB7H37h7GE3nFw2K68?=
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
X-OriginatorOrg: ncsc.gov.uk
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-AuthSource: LO2P123MB7051.GBRP123.PROD.OUTLOOK.COM
X-MS-Exchange-CrossTenant-Network-Message-Id: 
 9b80f2e3-bca7-4b3f-5bed-08de11860bb7
X-MS-Exchange-CrossTenant-originalarrivaltime: 22 Oct 2025 16:14:15.2899
 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 14aa5744-ece1-474e-a2d7-34f46dda64a1
X-MS-Exchange-CrossTenant-mailboxtype: HOSTED
X-MS-Exchange-CrossTenant-userprincipalname: 
 VFBtP9MIbJnlIdJdTnRExG8Grd6YInNSQU5QKIsiZpKYRxi/mc5yCrK7h1aTTKHGgZ4Q74JV5EPnjfYpE8VlqA==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: CWXP123MB3222
Message-ID-Hash: 46HR726PWYU6VKR475UMEPNDTCTU5Q5A
X-Message-ID-Hash: 46HR726PWYU6VKR475UMEPNDTCTU5Q5A
X-MailFrom: Peter.C@ncsc.gov.uk
X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency;
 loop; banned-address; member-moderation; header-match-cfrg.irtf.org-0;
 header-match-cfrg.irtf.org-1; nonmember-moderation; administrivia;
 implicit-dest; max-recipients; max-size; news-moderation; no-subject;
 digests; suspicious-header
CC: "Bellebaum,
 Thomas" <thomas.bellebaum=40aisec.fraunhofer.de@dmarc.ietf.org>,
 "lucas.prabel=40huawei.com@dmarc.ietf.org"
 <lucas.prabel=40huawei.com@dmarc.ietf.org>
X-Mailman-Version: 3.3.9rc6
Precedence: list
Subject: =?utf-8?q?=5BCFRG=5D_Re=3A_FW=3A_New_Version_Notification_for_draft-prabel-c?=
 =?utf-8?q?frg-suf-hybrid-sigs-00=2Etxt?=
List-Id: Crypto Forum Research Group <cfrg.irtf.org>
Archived-At: 
 <https://mailarchive.ietf.org/arch/msg/cfrg/FCnj6RwgOeR9s3FDGvwLcTtNyRQ>
List-Archive: <https://mailarchive.ietf.org/arch/browse/cfrg>
List-Help: <mailto:cfrg-request@irtf.org?subject=help>
List-Owner: <mailto:cfrg-owner@irtf.org>
List-Post: <mailto:cfrg@irtf.org>
List-Subscribe: <mailto:cfrg-join@irtf.org>
List-Unsubscribe: <mailto:cfrg-leave@irtf.org>

OFFICIAL

> 3. It may even be possible to use the non-blackbox construction to cover
> some RSA signatures.

The non-blackbox construction in the draft is BoP-2 from [Jan25].  BoP-3
applies directly to (randomised) RSA-FDH and RSASSA-PSS, and it avoids
the additional Message-Bound Security and Random-Message Validity
assumptions on the post-quantum component.

Peter

> -----Original Message-----
> From: Bellebaum, Thomas
> <thomas.bellebaum=3D40aisec.fraunhofer.de@dmarc.ietf.org>
> Sent: 22 October 2025 15:40
> To: lucas.prabel=3D40huawei.com@dmarc.ietf.org
> Cc: cfrg@ietf.org
> Subject: [CFRG] Re: FW: New Version Notification for draft-prabel-cfrg-su=
f-
> hybrid-sigs-00.txt
>
> Nice, thank you, especially for the non-blackbox analysis :)
>
> I do have some initial comments:
>
> 1. You might want to be more specific when stating that RSA is not SUF-CM=
A.
> There are multiple RSA-derived signature schemes, and some of them are
> indeed SUF-CMA. See also below.
>
> 2. Some of the PQ-requirements for the non-blackbox variant are easily
> covered using simple transformations such as adding a hash of message m''
> and public key pk2 to the signature s2. The overhead in the signature siz=
e
> seems negligable compared to most PQ signature sizes and to the time
> required for researchers to analyze each possible signature scheme for th=
ese
> properties individually. The same goes for many of the additional defense=
s
> present in e.g. draft-josefsson-cfrg-mothma.
>
> 3. It may even be possible to use the non-blackbox construction to cover
> some RSA signatures.
> This would ease the transition for some people with hardware without ECC
> support. (That said, if one is investing in PQ-algorithms, one might as w=
ell
> invest in ECC hardware.)
> Specifically, think of the following ID-scheme for RSA public key (n,e) a=
nd
> private key d:
>
> - The prover outputs the empty commitment ""
> - The verifier outputs a random challenge y in [0,n-1]
> - The prover outputs the (unique; easy to check) response x :=3D y^d mod =
n
>
> This simple ID-scheme is of course secure against direct attacks (assumin=
g
> RSA is a trapdoor permutation) and zero knowledge (Simulator picks x at
> random, and given the public key calculates y).
>
> Compiling this down using Fiat Shamir yields basically the Full Domain Ha=
sh,
> although the lack of an unpredictable commitment scheme means that the
> usual generic proof needs to be reworked slightly: Instead of arguing tha=
t the
> FS-transform never evaluates the Challenge-hash at a point previously
> queried to the random oracle, one argues that even if that happens the
> random oracle could have generated its outputs using the simulator. Note =
that
> this is basically what the standard FDH proof does.
>
> Alternatively, one can send a random string as commitment and rely on the
> more standard FS transform. If you pull some trickery in the challenge
> generation such that the random commitment can be recovered from y, you
> get RSA-PSS after a more standard FS transform. Again, this is very much =
along
> the lines of the RSA-PSS security argument.
>
> Best,
>
> -- TBB

OFFICIAL