Re: [Cfrg] I-D Action: draft-irtf-cfrg-xmss-hash-based-signatures-06.txt

[Kyle Rose <[e-mail]>]

>
> 3. "Politics": Should we deploy post-quantum crypto now, possibly at the
> cost of not deploying advanced "classical" crypto.
>
It's not just politics. For most online use cases, confidentiality must be
maintained for a longer period than authenticity, as Ilari pointed out to
me on the TLS list last week. (I.e., authenticators can be good for a
limited time only and then rotated, and so only need to be better than
attacks expected during that window, whereas encrypted data can't be
rotated once it's been recorded by an adversary for decryption later based
on new techniques or machinery.)

So PQ signatures aren't generally as important for deployment today as PQ
key exchange is. Unfortunately, the crypto community has much less
confidence in the schemes for the latter than for the former: research and
cryptanalysis, not standards development, are the blockers there.

This is not to be interpreted as a knock on hash-based signatures, which
are probably the future if quantum computers become a real thing, only that
it's not clear that there's any tangible benefit in the near future beyond
gaining experience with new schemes. In particular, I think any caution
expressed regarding XMSS should be directed mostly at state management,
which is where screw-ups are most likely.

Kyle