Re: [CFRG] NSA vs. hybrid

[Natanael <[e-mail]>]

Den mån 15 nov. 2021 17:14Ilari Liusvaara <[e-mail]> skrev:

> On Sun, Nov 14, 2021 at 10:49:29PM +0100, Jeff Burdges wrote:
> >
> > It’s always possible logic bugs arise in validation code of course,
> > but test vectors can trivially catch these bugs, assuming the
> > certificate format specifies both key types and the hybrid protocol.
>
> Catching those bugs may be far from trivial. Buggy signature
> verification code might have false accepts that are not trivial to
> generate, but still greatly weaken the security. One can not
> catch those with test vectors.
>
> I have not looked at if there are easy-to-make mistakes in
> signature verification of NISTPQC candidates that would behave in
> that way (not be obviously broken but still exploitable).
>
> > It’s fairly clear separate P and Q certificate chains obstruct test
> > vectors from enforcing this and invite more opportunities for
> > downgrade attacks, etc. too.
>
> IMO, The complexity of separate P and Q chain verification is
> absolutely terrifying. As for downgrade attacks, it is not clear how to
> deal with that even in theory, let alone in practice.
>

Besides committing to the algorithm negotiation as in TLS 1.3 to prevent
regular downgrade attacks, there also needs to be a policy that post
quantum CA:s can only sign post quantum certs (or hybrid certs), and that
hybrid CA:s can ONLY sign hybrid certs up until some predefined transition
period has ended (under the assumption that the CA cert gets deprecated
then with hybrid requirement renewed if we're not yet certain of the
strength of post quantum algorithms).

If we feel certain enough at the end of that period that the post quantum
algorithm will hold, then it remains valid and gets to sign post quantum
only certs.

The next two problems are that nobody will agree on the length of that
period, and that CA rollover is still problematic (just see the recent
let's encrypt issues on older devices).