Re: [Cfrg] I-D Action: draft-irtf-cfrg-xmss-hash-based-signatures-06.txt

["Paterson, Kenny" <[e-mail]>]

Hi Watson,

On 23/07/2016 17:03, "Watson Ladd" <[e-mail]> wrote:

>On Sat, Jul 23, 2016 at 7:35 AM, Paterson, Kenny
><[e-mail]> wrote:
>> Dear Andreas,
>>
>> Thanks for pushing the new version.
>>
>> Stephen and I had a chat at IETF 96 this week. His original suggestion
>>for
>> text to be added was this [1]:
>>
>> "All quantum-resistant algorithms documented by CFRG are today
>> considered ready for experimentation and further engineering
>> development (e.g. to establish the impact of performance and sizes
>> on IETF protocols) but CFRG has consensus that we are not yet
>> sufficiently confident to the point where we would want the security
>> or privacy of a significant part of the Internet to be dependent on
>> any set of those algorithms. In future, as things mature, CFRG
>> intends to publish updated guidance on this topic."
>>
>> Personally, I think this is too strong for hash-based signatures:
>>although
>> we have no deployment experience (that I know of), we do have fairly
>> strong confidence in the security of hash-based signatures against
>>quantum
>> computers, given the current state of the art of research in quantum
>> algorithms. I'd suggest instead that some text like this should be
>> included:
>>
>>
>> "All quantum-resistant algorithms documented by CFRG are today
>> considered ready for experimentation and further engineering
>> development (e.g. to establish the impact of performance and sizes
>> on IETF protocols). However, at the time of writing, we do not have
>> significant deployment experience with such algorithms.
>> CFRG consensus is that we are confident in the security of the
>> signature schemes described in this document against
>>
>> quantum computers, given the current state of the research
>> community's knowledge about quantum algorithms. Indeed, we are
>> confident that the security of a significant part of the Internet
>> could be made dependent on the signature schemes defined in this
>> document."
>>
>> I realise that's a pretty strong statement that is the opposite of what
>> Stephen suggested *for these signature schemes*.
>>
>> So let's discuss a bit more, and see if there is consensus from CFRG for
>> the statement I've made here. Happy also to receive suggestions for
>> alternative, better-worded statements.
>
>I like the second in terms of what it means.
>
>Minor wordsmithing suggestions: Remove "given the current state of the
>research community's knowledge about quantum algorithms". This caveat
>applies to almost all schemes: new attacks could be discovered later.

Fair enough.

>The last sentence seems a bit too strong and redundant at the same
>time. We're assuming we could make the Internet work with this, but
>don't have deployment experience. How about "This scheme is
>sufficiently secure for use in all Internet protocols, and it will
>require deployment experience to see if its use is feasible"? I
>wouldn't object to the current text either.

Your proposal is definitely better, thanks.

Cheers

Kenny

>
>>
>> Cheers,
>>
>>
>> Kenny
>>
>> [1] https://www.ietf.org/mail-archive/web/cfrg/current/msg08315.html
>>
>> On 06/07/2016 15:53, "Cfrg on behalf of A. Huelsing"
>> <[e-mail] on behalf of [e-mail]> wrote:
>>
>>>Hi,
>>>
>>>we pushed a new version that further simplifies the addresses due to a
>>>comment we received off-list. It is a minor change that simplifies
>>>implementation of addresses as u_int32 array. We did not take any action
>>>regarding Stephens comment, yet. For this we want to get more feedback
>>>on what we should do.
>>>
>>>Andreas
>>>
>>>
>>>
>>>On 07/06/16 16:45, [e-mail] wrote:
>>>> A New Internet-Draft is available from the on-line Internet-Drafts
>>>>directories.
>>>> This draft is a work item of the Crypto Forum of the IETF.
>>>>
>>>>         Title           : XMSS: Extended Hash-Based Signatures
>>>>         Authors         : Andreas Huelsing
>>>>                           Denis Butin
>>>>                           Stefan-Lukas Gazdag
>>>>                           Aziz Mohaisen
>>>>      Filename        :
>>>>draft-irtf-cfrg-xmss-hash-based-signatures-06.txt
>>>>      Pages           : 66
>>>>      Date            : 2016-07-06
>>>>
>>>> Abstract:
>>>>    This note describes the eXtended Merkle Signature Scheme (XMSS), a
>>>>    hash-based digital signature system.  It follows existing
>>>>    descriptions in scientific literature.  The note specifies the
>>>>WOTS+
>>>>    one-time signature scheme, a single-tree (XMSS) and a multi-tree
>>>>    variant (XMSS^MT) of XMSS.  Both variants use WOTS+ as a main
>>>>    building block.  XMSS provides cryptographic digital signatures
>>>>    without relying on the conjectured hardness of mathematical
>>>>problems.
>>>>    Instead, it is proven that it only relies on the properties of
>>>>    cryptographic hash functions.  XMSS provides strong security
>>>>    guarantees and is even secure when the collision resistance of the
>>>>    underlying hash function is broken.  It is suitable for compact
>>>>    implementations, relatively simple to implement, and naturally
>>>>    resists side-channel attacks.  Unlike most other signature systems,
>>>>    hash-based signatures withstand attacks using quantum computers.
>>>>
>>>>
>>>> The IETF datatracker status page for this draft is:
>>>>
>>>>https://datatracker.ietf.org/doc/draft-irtf-cfrg-xmss-hash-based-signat
>>>>ur
>>>>es/
>>>>
>>>> There's also a htmlized version available at:
>>>>
>>>>https://tools.ietf.org/html/draft-irtf-cfrg-xmss-hash-based-signatures-
>>>>06
>>>>
>>>> A diff from the previous version is available at:
>>>>
>>>>https://www.ietf.org/rfcdiff?url2=draft-irtf-cfrg-xmss-hash-based-signa
>>>>tu
>>>>res-06
>>>>
>>>>
>>>> Please note that it may take a couple of minutes from the time of
>>>>submission
>>>> until the htmlized version and diff are available at tools.ietf.org.
>>>>
>>>> Internet-Drafts are also available by anonymous FTP at:
>>>> ftp://ftp.ietf.org/internet-drafts/
>>>>
>>>> _______________________________________________
>>>> Cfrg mailing list
>>>> [e-mail]
>>>> https://www.irtf.org/mailman/listinfo/cfrg
>>>
>>>_______________________________________________
>>>Cfrg mailing list
>>>[e-mail]
>>>https://www.irtf.org/mailman/listinfo/cfrg
>>
>> _______________________________________________
>> Cfrg mailing list
>> [e-mail]
>> https://www.irtf.org/mailman/listinfo/cfrg
>
>
>
>-- 
>"Man is born free, but everywhere he is in chains".
>--Rousseau.