Re: [Cfrg] BLS Signature for X.509

Dan Brown <danibrown@blackberry.com> Thu, 06 October 2016 15:05 UTC

Return-Path: <danibrown@blackberry.com>
X-Original-To: cfrg@ietfa.amsl.com
Delivered-To: cfrg@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 741C71295F6 for <cfrg@ietfa.amsl.com>; Thu, 6 Oct 2016 08:05:21 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -5.596
X-Spam-Level:
X-Spam-Status: No, score=-5.596 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, RP_MATCHES_RCVD=-2.996, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id x_fLbm9jZlGX for <cfrg@ietfa.amsl.com>; Thu, 6 Oct 2016 08:05:16 -0700 (PDT)
Received: from smtp-p02.blackberry.com (smtp-p02.blackberry.com [208.65.78.89]) (using TLSv1 with cipher RC4-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 52F75129688 for <cfrg@irtf.org>; Thu, 6 Oct 2016 08:05:13 -0700 (PDT)
Received: from smtp-pop.rim.net (HELO XCT103CNC.rim.net) ([10.65.161.203]) by mhs213cnc.rim.net with ESMTP/TLS/DHE-RSA-AES256-SHA; 06 Oct 2016 14:38:39 -0400
Received: from XMB116CNC.rim.net ([fe80::45d:f4fe:6277:5d1b]) by XCT103CNC.rim.net ([fe80::b8:d5e:26a5:f4d6%17]) with mapi id 14.03.0210.002; Thu, 6 Oct 2016 11:04:31 -0400
From: Dan Brown <danibrown@blackberry.com>
To: Antonio Sanso <asanso@adobe.com>
Thread-Topic: [Cfrg] BLS Signature for X.509
Thread-Index: AQHSGufpbY1YYOxHykaegiXLdxYgpKCX1qkAgADnsICAAR9VgIAAkh6A//+/ZKCAAXYaAP//6AR7gAACwrE=
Date: Thu, 6 Oct 2016 15:04:30 +0000
Message-ID: <810C31990B57ED40B2062BA10D43FBF50103A08B@XMB116CNC.rim.net>
References: <9E7BD18D-496F-4F93-9DC6-EC49B56825D2@adobe.com> <00F862CA-EBC6-43C5-B3E1-9EEC3BB01A81@adobe.com> <CAKDPBw8Em9Wp=+e9ML2Uqki65bOXzT_UEqK8_xp_W8xMypN=uw@mail.gmail.com> <D94DA7EC-8C8F-4B00-BE42-022CCA3A6E1A@adobe.com> <CAKDPBw9=5T9CefNquaK_FP5-yTyt-o+1XWOaUtqtnXUmDz1PnQ@mail.gmail.com> <810C31990B57ED40B2062BA10D43FBF501036BBF@XMB116CNC.rim.net>, <E6D9AB05-CB0E-4C91-9049-C22EE6C499AE@adobe.com>
In-Reply-To: <E6D9AB05-CB0E-4C91-9049-C22EE6C499AE@adobe.com>
Accept-Language: en-US, en-CA
Content-Language: en-US
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
x-mimectl: Produced By Microsoft Exchange V14.3.123.2
x-originating-ip: [10.65.160.248]
Content-Type: multipart/alternative; boundary="_000_810C31990B57ED40B2062BA10D43FBF50103A08BXMB116CNCrimnet_"
MIME-Version: 1.0
Archived-At: <https://mailarchive.ietf.org/arch/msg/cfrg/Wezw9-ID-QPkbDaLamDQetWcPy0>
Cc: "cfrg@irtf.org" <cfrg@irtf.org>
Subject: Re: [Cfrg] BLS Signature for X.509
X-BeenThere: cfrg@irtf.org
X-Mailman-Version: 2.1.17
Precedence: list
List-Id: Crypto Forum Research Group <cfrg.irtf.org>
List-Unsubscribe: <https://www.irtf.org/mailman/options/cfrg>, <mailto:cfrg-request@irtf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/cfrg/>
List-Post: <mailto:cfrg@irtf.org>
List-Help: <mailto:cfrg-request@irtf.org?subject=help>
List-Subscribe: <https://www.irtf.org/mailman/listinfo/cfrg>, <mailto:cfrg-request@irtf.org?subject=subscribe>
X-List-Received-Date: Thu, 06 Oct 2016 15:05:21 -0000

The risks (as in potential or theoretical risk) of pairing-groups are (1) newer (usual for any new crypto), (2) recent progress in finite field DLP over certain extension fields, e.g Barbulescu et al. quasi-polynomial time [see also http://eprint.iacr.org/2016/914].  Does BLS somehow bypass these risks?  Or is there is a choice of pairing-group that is not deemed risky?

________________________________
From: Antonio Sanso [asanso@adobe.com]
Sent: Thursday, October 06, 2016 8:20 AM
To: Dan Brown
Cc: Paul Grubbs; cfrg@irtf.org
Subject: Re: [Cfrg] BLS Signature for X.509

hi Dan

On Oct 5, 2016, at 8:18 PM, Dan Brown <danibrown@blackberry.com<mailto:danibrown@blackberry.com>> wrote:

Hi Antonio,

Can you briefly expand on the advantages of BLS, especially the aggregation of chains [citing also a reference]?

here a couple of references

http://theory.stanford.edu/~dfreeman/cs259c-f11/finalpapers/aggregatesigs.pdf
https://crypto.stanford.edu/~dabo/papers/aggsurvey.pdf

AFAIU if the signature used is BLS  there is not need to calculate the certificate chain since any “node” involved can "fully proof" the “chain” .

  How well are these advantages aligned with IETF needs?  At the moment, I’m a little skeptical that the benefits (smaller chains?) outweigh the risks (relying on pairing-groups), but I could be wrong.

are  you aware of any risk of using BLS. I am not so far….


Just to be clear, although BLS uses pairing-groups, it does not have any escrow worries (unlike IBE etc.), or am I badly mistaken?

Is BLS standardized elsewhere (ISO, IEEE 1363*, etc.)?

In any event, you could prepare an individual I-D to propose BLS to IETF, although I do not how much it would be accepted.

if there is any interest I would be happy to take a stub and write a draft. Is there anyone interested to join the effort?

regards

antonio


Pairing-groups have been proposed for in use IETF before:
https://datatracker.ietf.org/doc/draft-budronimccusker-milagrotls/
https://datatracker.ietf.org/doc/rfc6508/
https://datatracker.ietf.org/doc/rfc6509/

Best regards,

Dan


From: Cfrg [mailto:cfrg-bounces@irtf.org] On Behalf Of Paul Grubbs
Sent: Wednesday, October 05, 2016 1:53 PM
To: Antonio Sanso <asanso@adobe.com<mailto:asanso@adobe.com>>
Cc: cfrg@irtf.org<mailto:cfrg@irtf.org>
Subject: Re: [Cfrg] BLS Signature for X.509

The IETF does play an important role in the process, but most people (at least in the US) won't consider anything in crypto 'standardized' unless it involves NIST.

On Wed, Oct 5, 2016 at 5:09 AM, Antonio Sanso <asanso@adobe.com<mailto:asanso@adobe.com>> wrote:
hi Paul,

thanks. Isn’t where this group can help though (namely standardization) ?

regards

antonio

On Oct 4, 2016, at 6:01 PM, Paul Grubbs <pag225@cornell.edu<mailto:pag225@cornell.edu>> wrote:


BLS signatures would be nice for many reasons. The lack of standardized pairing groups makes it a little difficult from a deployability perspective, I think.

On Tue, Oct 4, 2016 at 2:12 AM, Antonio Sanso <asanso@adobe.com<mailto:asanso@adobe.com>> wrote:
anyome :S ?

On Sep 30, 2016, at 8:57 AM, Antonio Sanso <asanso@adobe.com<mailto:asanso@adobe.com>> wrote:

> hi *,
>
> sorry for the noise.
> I was wondering if it was already discussed the idea to use BSL Signature for X.509.
> AFAIK this will avoid certificate chains thanks to the signature aggregation property…
> If this was already discussed I apologize.
> If not WDYT about this?
>
> regards
>
> antonio
> _______________________________________________
> Cfrg mailing list
> Cfrg@irtf.org<mailto:Cfrg@irtf.org>
> https://www.irtf.org/mailman/listinfo/cfrg

_______________________________________________
Cfrg mailing list
Cfrg@irtf.org<mailto:Cfrg@irtf.org>
https://www.irtf.org/mailman/listinfo/cfrg