Re: [Cfrg] I-D Action: draft-irtf-cfrg-xmss-hash-based-signatures-06.txt

[Watson Ladd <[e-mail]>]

On Sat, Jul 23, 2016 at 7:35 AM, Paterson, Kenny
<[e-mail]> wrote:
> Dear Andreas,
>
> Thanks for pushing the new version.
>
> Stephen and I had a chat at IETF 96 this week. His original suggestion for
> text to be added was this [1]:
>
> "All quantum-resistant algorithms documented by CFRG are today
> considered ready for experimentation and further engineering
> development (e.g. to establish the impact of performance and sizes
> on IETF protocols) but CFRG has consensus that we are not yet
> sufficiently confident to the point where we would want the security
> or privacy of a significant part of the Internet to be dependent on
> any set of those algorithms. In future, as things mature, CFRG
> intends to publish updated guidance on this topic."
>
> Personally, I think this is too strong for hash-based signatures: although
> we have no deployment experience (that I know of), we do have fairly
> strong confidence in the security of hash-based signatures against quantum
> computers, given the current state of the art of research in quantum
> algorithms. I'd suggest instead that some text like this should be
> included:
>
>
> "All quantum-resistant algorithms documented by CFRG are today
> considered ready for experimentation and further engineering
> development (e.g. to establish the impact of performance and sizes
> on IETF protocols). However, at the time of writing, we do not have
> significant deployment experience with such algorithms.
> CFRG consensus is that we are confident in the security of the
> signature schemes described in this document against
>
> quantum computers, given the current state of the research
> community's knowledge about quantum algorithms. Indeed, we are
> confident that the security of a significant part of the Internet
> could be made dependent on the signature schemes defined in this
> document."
>
> I realise that's a pretty strong statement that is the opposite of what
> Stephen suggested *for these signature schemes*.
>
> So let's discuss a bit more, and see if there is consensus from CFRG for
> the statement I've made here. Happy also to receive suggestions for
> alternative, better-worded statements.

I like the second in terms of what it means.

Minor wordsmithing suggestions: Remove "given the current state of the
research community's knowledge about quantum algorithms". This caveat
applies to almost all schemes: new attacks could be discovered later.

The last sentence seems a bit too strong and redundant at the same
time. We're assuming we could make the Internet work with this, but
don't have deployment experience. How about "This scheme is
sufficiently secure for use in all Internet protocols, and it will
require deployment experience to see if its use is feasible"? I
wouldn't object to the current text either.

>
> Cheers,
>
>
> Kenny
>
> [1] https://www.ietf.org/mail-archive/web/cfrg/current/msg08315.html
>
> On 06/07/2016 15:53, "Cfrg on behalf of A. Huelsing"
> <[e-mail] on behalf of [e-mail]> wrote:
>
>>Hi,
>>
>>we pushed a new version that further simplifies the addresses due to a
>>comment we received off-list. It is a minor change that simplifies
>>implementation of addresses as u_int32 array. We did not take any action
>>regarding Stephens comment, yet. For this we want to get more feedback
>>on what we should do.
>>
>>Andreas
>>
>>
>>
>>On 07/06/16 16:45, [e-mail] wrote:
>>> A New Internet-Draft is available from the on-line Internet-Drafts
>>>directories.
>>> This draft is a work item of the Crypto Forum of the IETF.
>>>
>>>         Title           : XMSS: Extended Hash-Based Signatures
>>>         Authors         : Andreas Huelsing
>>>                           Denis Butin
>>>                           Stefan-Lukas Gazdag
>>>                           Aziz Mohaisen
>>>      Filename        : draft-irtf-cfrg-xmss-hash-based-signatures-06.txt
>>>      Pages           : 66
>>>      Date            : 2016-07-06
>>>
>>> Abstract:
>>>    This note describes the eXtended Merkle Signature Scheme (XMSS), a
>>>    hash-based digital signature system.  It follows existing
>>>    descriptions in scientific literature.  The note specifies the WOTS+
>>>    one-time signature scheme, a single-tree (XMSS) and a multi-tree
>>>    variant (XMSS^MT) of XMSS.  Both variants use WOTS+ as a main
>>>    building block.  XMSS provides cryptographic digital signatures
>>>    without relying on the conjectured hardness of mathematical problems.
>>>    Instead, it is proven that it only relies on the properties of
>>>    cryptographic hash functions.  XMSS provides strong security
>>>    guarantees and is even secure when the collision resistance of the
>>>    underlying hash function is broken.  It is suitable for compact
>>>    implementations, relatively simple to implement, and naturally
>>>    resists side-channel attacks.  Unlike most other signature systems,
>>>    hash-based signatures withstand attacks using quantum computers.
>>>
>>>
>>> The IETF datatracker status page for this draft is:
>>>
>>>https://datatracker.ietf.org/doc/draft-irtf-cfrg-xmss-hash-based-signatur
>>>es/
>>>
>>> There's also a htmlized version available at:
>>>
>>>https://tools.ietf.org/html/draft-irtf-cfrg-xmss-hash-based-signatures-06
>>>
>>> A diff from the previous version is available at:
>>>
>>>https://www.ietf.org/rfcdiff?url2=draft-irtf-cfrg-xmss-hash-based-signatu
>>>res-06
>>>
>>>
>>> Please note that it may take a couple of minutes from the time of
>>>submission
>>> until the htmlized version and diff are available at tools.ietf.org.
>>>
>>> Internet-Drafts are also available by anonymous FTP at:
>>> ftp://ftp.ietf.org/internet-drafts/
>>>
>>> _______________________________________________
>>> Cfrg mailing list
>>> [e-mail]
>>> https://www.irtf.org/mailman/listinfo/cfrg
>>
>>_______________________________________________
>>Cfrg mailing list
>>[e-mail]
>>https://www.irtf.org/mailman/listinfo/cfrg
>
> _______________________________________________
> Cfrg mailing list
> [e-mail]
> https://www.irtf.org/mailman/listinfo/cfrg



-- 
"Man is born free, but everywhere he is in chains".
--Rousseau.