Re: [COSE] Comments on draft-ietf-cose-hash-sig-01

[Russ Housley <[e-mail]>]

Stephen:

This section is just offering the reason for someone to implement hash-based signatures.

Russ


> On Apr 29, 2019, at 7:04 PM, Stephen Farrell <[e-mail]> wrote:
> 
> Hi Russ,
> 
> Sorry, I hadn't read this 'till just now, when the
> text below made me wonder.
> 
> I don't get the logic for including most of the text
> in this draft (other than section 3, the samples and
> IANA stuff).
> 
> Why would this draft be introducing Shor and LMS etc?
> That seems like a thing to be done by reference only.
> (It may make sense for the draft to include this text
> but for it to not be in an eventual RFC I guess.)
> 
> S.
> 
> 
> On 29/04/2019 23:52, Russ Housley wrote:
>> John:
>> 
>> I was revisiting an old comment from you.
>> 
>>> - Section 1.1: I think some short info on the threat from Shor's algorithm would be good. I don't think [BH2013] talked about quantum computers.
>> 
>> There are two major points in this section: advances in cryptanalysis and advances in the development of quantum computers.  The presentation in [BH2103] is about advances in cryptanalysis, not quantum computers.
>> 
>> Does this make that more clear?
>> 
>>   There have been recent advances in cryptanalysis and advances in the
>>   development of quantum computers.  Each of these advances pose a
>>   threat to widely deployed digital signature algorithms.
>> 
>>   At Black Hat USA 2013, some researchers gave a presentation on the
>>   current state of public key cryptography.  They said: "Current
>>   cryptosystems depend on discrete logarithm and factoring which has
>>   seen some major new developments in the past 6 months" [BH2013].  Due
>>   to advances in cryptanalysis, they encouraged preparation for a day
>>   when RSA and DSA cannot be depended upon.
>> 
>>   Peter Shor showed that a large-scale quantum computer could be used
>>   to factor a number in polynomial time [S1997], effectively
>>   breaking RSA.  If large-scale quantum computers are ever built, these
>>   computers will be able to break many of the public-key cryptosystems
>>   currently in use.  A post-quantum cryptosystem [PQC] is a system that
>>   is secure against quantum computers that have more than a trivial
>>   number of quantum bits (qu-bits).  It is open to conjecture when it
>>   will be feasible to build such computers; however, RSA, DSA, ECDSA,
>>   and EdDSA are all vulnerable if large-scale quantum computers come to
>>   pass.
>> 
>>   The HSS/LMS signature algorithm does not depend on the difficulty of
>>   discrete logarithm or factoring, as a result these algorithms are
>>   considered to be post-quantum secure.
>> 
>> Thanks,
>>  Russ