Re: [COSE] Comments on draft-ietf-cose-hash-sig-01

[Russ Housley <[e-mail]>]

John:

I was revisiting an old comment from you.

> - Section 1.1: I think some short info on the threat from Shor's algorithm would be good. I don't think [BH2013] talked about quantum computers.

There are two major points in this section: advances in cryptanalysis and advances in the development of quantum computers.  The presentation in [BH2103] is about advances in cryptanalysis, not quantum computers.

Does this make that more clear?

   There have been recent advances in cryptanalysis and advances in the
   development of quantum computers.  Each of these advances pose a
   threat to widely deployed digital signature algorithms.

   At Black Hat USA 2013, some researchers gave a presentation on the
   current state of public key cryptography.  They said: "Current
   cryptosystems depend on discrete logarithm and factoring which has
   seen some major new developments in the past 6 months" [BH2013].  Due
   to advances in cryptanalysis, they encouraged preparation for a day
   when RSA and DSA cannot be depended upon.

   Peter Shor showed that a large-scale quantum computer could be used
   to factor a number in polynomial time [S1997], effectively
   breaking RSA.  If large-scale quantum computers are ever built, these
   computers will be able to break many of the public-key cryptosystems
   currently in use.  A post-quantum cryptosystem [PQC] is a system that
   is secure against quantum computers that have more than a trivial
   number of quantum bits (qu-bits).  It is open to conjecture when it
   will be feasible to build such computers; however, RSA, DSA, ECDSA,
   and EdDSA are all vulnerable if large-scale quantum computers come to
   pass.

   The HSS/LMS signature algorithm does not depend on the difficulty of
   discrete logarithm or factoring, as a result these algorithms are
   considered to be post-quantum secure.

Thanks,
  Russ