Re: [CFRG] NSA vs. hybrid

[Ilari Liusvaara <[e-mail]>]

On Sun, Nov 14, 2021 at 10:49:29PM +0100, Jeff Burdges wrote:
> 
> It’s always possible logic bugs arise in validation code of course,
> but test vectors can trivially catch these bugs, assuming the
> certificate format specifies both key types and the hybrid protocol.

Catching those bugs may be far from trivial. Buggy signature
verification code might have false accepts that are not trivial to
generate, but still greatly weaken the security. One can not
catch those with test vectors.

I have not looked at if there are easy-to-make mistakes in
signature verification of NISTPQC candidates that would behave in
that way (not be obviously broken but still exploitable).

> It’s fairly clear separate P and Q certificate chains obstruct test
> vectors from enforcing this and invite more opportunities for
> downgrade attacks, etc. too.

IMO, The complexity of separate P and Q chain verification is
absolutely terrifying. As for downgrade attacks, it is not clear how to
deal with that even in theory, let alone in practice.

> It’s all trickier if you want the extreme algorithm agility of TLS of
> course, but not any harder than making separate P and Q certificate
> chains work correctly.  

Actually, separate chains do not work in TLS. The problem is that
there can be only one handshake signature and only one end entity
certificate, and thus only one CA signature for end-entity
certificate. 


-Ilari