Re: [COSE] [jose] ML-DSA & SLH-DSA for JOSE and COSE

[Ilari Liusvaara <[e-mail]>]

On Fri, Jan 12, 2024 at 04:02:54PM -0600, Orie Steele wrote:
> Hello Post Quantum Enthusiasts,
> 
> We apologize for allowing the drafts to expire, that has now been corrected.
> 
> We've published new versions and done a tooling migration to the COSE WG
> GitHub repository:
> 
> - https://github.com/cose-wg/draft-ietf-cose-dilithium
> - https://github.com/cose-wg/draft-ietf-cose-sphincs-plus
> 
> I'd like to take this opportunity to complain a bit about this part of the
> FIPS 205 IPD:
> 
> " This standard approves 12 parameter sets for use with SLH-DSA. "
> 
> I feel this is a mistake, and wonder if there is any opportunity to reduce
> this to something less than 4x the number defined by ML-DSA.
> 
> Even if NIST preserves all 12, we don't have to register all 12 in
> draft-ietf-cose-sphincs-plus.

Well, there are discussions about adding even more. :-)

And there are discussions about prehashing... Which I think could be
quite a bit worse to deal with than 12 parameter sets... :-/


> Of course, we will do whatever the working group thinks is correct here...
> what should we do?

Oh, ML-DSA and SLH-DSA are both from the same cryptographic algorithm
family (the two have the same type of key).




-Ilari