Re: [COSE] Comments on draft-ietf-cose-hash-sig-01

[Russ Housley <[e-mail]>]

I can drop Section 1.1 if others think that is the best way forward.  I think this document is ready for WG Last Call.  Maybe we can explictly ask whether Section 1.1 should be kept or dropped.

Russ


> On Apr 30, 2019, at 7:54 AM, Stephen Farrell <[e-mail]> wrote:
> 
> Signed PGP part
> 
> Hiya,
> 
> On 30/04/2019 12:37, Russ Housley wrote:
>> Stephen:
>> 
>> This section is just offering the reason for someone to implement
>> hash-based signatures.
> 
> Sure. I'd suggest not leaving that in the RFC though,
> otherwise you may end up adding the same text every
> time you wanna define anything related to hash based
> sigs, and that text will likely get outdated I'd guess.
> 
> S.
> 
>> 
>> Russ
>> 
>> 
>>> On Apr 29, 2019, at 7:04 PM, Stephen Farrell
>>> <[e-mail]> wrote:
>>> 
>>> Hi Russ,
>>> 
>>> Sorry, I hadn't read this 'till just now, when the text below made
>>> me wonder.
>>> 
>>> I don't get the logic for including most of the text in this draft
>>> (other than section 3, the samples and IANA stuff).
>>> 
>>> Why would this draft be introducing Shor and LMS etc? That seems
>>> like a thing to be done by reference only. (It may make sense for
>>> the draft to include this text but for it to not be in an eventual
>>> RFC I guess.)
>>> 
>>> S.
>>> 
>>> 
>>> On 29/04/2019 23:52, Russ Housley wrote:
>>>> John:
>>>> 
>>>> I was revisiting an old comment from you.
>>>> 
>>>>> - Section 1.1: I think some short info on the threat from
>>>>> Shor's algorithm would be good. I don't think [BH2013] talked
>>>>> about quantum computers.
>>>> 
>>>> There are two major points in this section: advances in
>>>> cryptanalysis and advances in the development of quantum
>>>> computers.  The presentation in [BH2103] is about advances in
>>>> cryptanalysis, not quantum computers.
>>>> 
>>>> Does this make that more clear?
>>>> 
>>>> There have been recent advances in cryptanalysis and advances in
>>>> the development of quantum computers.  Each of these advances
>>>> pose a threat to widely deployed digital signature algorithms.
>>>> 
>>>> At Black Hat USA 2013, some researchers gave a presentation on
>>>> the current state of public key cryptography.  They said:
>>>> "Current cryptosystems depend on discrete logarithm and factoring
>>>> which has seen some major new developments in the past 6 months"
>>>> [BH2013].  Due to advances in cryptanalysis, they encouraged
>>>> preparation for a day when RSA and DSA cannot be depended upon.
>>>> 
>>>> Peter Shor showed that a large-scale quantum computer could be
>>>> used to factor a number in polynomial time [S1997], effectively
>>>> breaking RSA.  If large-scale quantum computers are ever built,
>>>> these computers will be able to break many of the public-key
>>>> cryptosystems currently in use.  A post-quantum cryptosystem
>>>> [PQC] is a system that is secure against quantum computers that
>>>> have more than a trivial number of quantum bits (qu-bits).  It is
>>>> open to conjecture when it will be feasible to build such
>>>> computers; however, RSA, DSA, ECDSA, and EdDSA are all vulnerable
>>>> if large-scale quantum computers come to pass.
>>>> 
>>>> The HSS/LMS signature algorithm does not depend on the difficulty
>>>> of discrete logarithm or factoring, as a result these algorithms
>>>> are considered to be post-quantum secure.
>>>> 
>>>> Thanks, Russ
>> 
>> 
>> _______________________________________________ COSE mailing list
>> [e-mail] https://www.ietf.org/mailman/listinfo/cose
>> 
> <0x5AB2FAF17B172BEA.asc>
> 
>