Re: [COSE] Comments on draft-ietf-cose-hash-sig-01

[Stephen Farrell <[e-mail]>]

Hi Russ,

Sorry, I hadn't read this 'till just now, when the
text below made me wonder.

I don't get the logic for including most of the text
in this draft (other than section 3, the samples and
IANA stuff).

Why would this draft be introducing Shor and LMS etc?
That seems like a thing to be done by reference only.
(It may make sense for the draft to include this text
but for it to not be in an eventual RFC I guess.)

S.


On 29/04/2019 23:52, Russ Housley wrote:
> John:
> 
> I was revisiting an old comment from you.
> 
>> - Section 1.1: I think some short info on the threat from Shor's algorithm would be good. I don't think [BH2013] talked about quantum computers.
> 
> There are two major points in this section: advances in cryptanalysis and advances in the development of quantum computers.  The presentation in [BH2103] is about advances in cryptanalysis, not quantum computers.
> 
> Does this make that more clear?
> 
>    There have been recent advances in cryptanalysis and advances in the
>    development of quantum computers.  Each of these advances pose a
>    threat to widely deployed digital signature algorithms.
> 
>    At Black Hat USA 2013, some researchers gave a presentation on the
>    current state of public key cryptography.  They said: "Current
>    cryptosystems depend on discrete logarithm and factoring which has
>    seen some major new developments in the past 6 months" [BH2013].  Due
>    to advances in cryptanalysis, they encouraged preparation for a day
>    when RSA and DSA cannot be depended upon.
> 
>    Peter Shor showed that a large-scale quantum computer could be used
>    to factor a number in polynomial time [S1997], effectively
>    breaking RSA.  If large-scale quantum computers are ever built, these
>    computers will be able to break many of the public-key cryptosystems
>    currently in use.  A post-quantum cryptosystem [PQC] is a system that
>    is secure against quantum computers that have more than a trivial
>    number of quantum bits (qu-bits).  It is open to conjecture when it
>    will be feasible to build such computers; however, RSA, DSA, ECDSA,
>    and EdDSA are all vulnerable if large-scale quantum computers come to
>    pass.
> 
>    The HSS/LMS signature algorithm does not depend on the difficulty of
>    discrete logarithm or factoring, as a result these algorithms are
>    considered to be post-quantum secure.
> 
> Thanks,
>   Russ
> 
> _______________________________________________
> COSE mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/cose
>