Re: [Curdle] call for adoption for draft-mu-curdle-ssh-xmss-00

Watson Ladd <> Fri, 22 November 2019 03:44 UTC

Return-Path: <>
Received: from localhost (localhost []) by (Postfix) with ESMTP id 4C281120833 for <>; Thu, 21 Nov 2019 19:44:31 -0800 (PST)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: -1.997
X-Spam-Status: No, score=-1.997 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=unavailable autolearn_force=no
Authentication-Results: (amavisd-new); dkim=pass (2048-bit key)
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id QDVFZBZ1XvqN for <>; Thu, 21 Nov 2019 19:44:29 -0800 (PST)
Received: from ( [IPv6:2a00:1450:4864:20::231]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by (Postfix) with ESMTPS id C77251200E5 for <>; Thu, 21 Nov 2019 19:44:28 -0800 (PST)
Received: by with SMTP id m4so5652550ljj.8 for <>; Thu, 21 Nov 2019 19:44:28 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=D3LeoUTIP5ef+k+IhT7RQGr4jtfAEeOgUfmDAUXd7ao=; b=HxZrEgTPz0YipZ8KbK0uZ6s+BpmsmlkAUr69wKWwK0S2kRUgulMvZP6GJAJvIHf9dc 9qrN6O2bnNUpWVclHC21G6K63HE+RTT39f1Q2NoPzUpzdvD+SIcbrEqyBDlJPpzMjB+I aYK7Z+mu2pxSanhi+kMAcX1OXzaO7h5Y6wwAvKvbwYERJkC789RG0zspDM4PSJhq6CNL BrdSQe9oJVBUf0dcav3PIlAUGTf2upBuZ2X34bgLCTNKKzhkQWknsBLVo+1jVoPJ1kUT 0d8TZGQKYO0HzfbYyVwLKVwinH9yU2jX1UGP8lXPIC7Q0LKn9ZlbyZkriBrGg1E0Q0WC WATw==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=D3LeoUTIP5ef+k+IhT7RQGr4jtfAEeOgUfmDAUXd7ao=; b=C1TTEhkf8uHbPNWxAi9VnFWG6OuLvrG9aTejP/JVHo1NOGN6zhZST4I6MwrFMw4Hgw 93KtClgFytItF/Ss1yfSBsAQZX+HOtqsqcgsOWGTuEf26mcrCEJXScJ99rwvXxHoyDzD VzGVSsCu7LvYmRwTLKz0MVcd2eGAmE/qxZRf/iNWbOQveslntwoJYrcbIOY/KUUlwSCQ Be0AnPxvwFalYVCu+EiFp6FIGygkxzL5oEKbQzMGxRB2DptG0kT47d59ThdH6BqFyZk/ S8Ev2pY7yiRxyLlu56CZpmN3eWTDVz5RlKttWY/ScstPWBKdrQgrkeFYlOKnpZGSnRvt /w+w==
X-Gm-Message-State: APjAAAU+u86d9WtfudxakWOlira+8cXQG1KtLdejRcwdB2Fwyan92PlW /M3RGk6huWsTK3RuFs/KBIi1fQBlIPZccYu/AuU=
X-Google-Smtp-Source: APXvYqx4aVfgzbg0cU3jTOZx1BsNsoUaBjI9OBGsdj2JeVwcqsaaO01IS4CBEqR1+SJMK4n0OAbp4BbAA1kn/FVtDoQ=
X-Received: by 2002:a2e:905a:: with SMTP id n26mr9710295ljg.165.1574394267009; Thu, 21 Nov 2019 19:44:27 -0800 (PST)
MIME-Version: 1.0
References: <>
In-Reply-To: <>
From: Watson Ladd <>
Date: Thu, 21 Nov 2019 22:44:15 -0500
Message-ID: <>
To: Daniel Van Geest <>
Cc: "Salz, Rich" <>, "Panos Kampanakis (pkampana)" <>, denis bider <>, curdle <>, Daniel Migault <>
Content-Type: multipart/alternative; boundary="0000000000000588330597e73b72"
Archived-At: <>
Subject: Re: [Curdle] call for adoption for draft-mu-curdle-ssh-xmss-00
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: "List for discussion of potential new security area wg." <>
List-Unsubscribe: <>, <>
List-Archive: <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>
X-List-Received-Date: Fri, 22 Nov 2019 03:44:31 -0000

On Thu, Nov 21, 2019 at 9:44 PM Daniel Van Geest <>

> NIST will issue a special publication on stateful hash-based signatures
> before the rest of the PQ process completes.  Based on today’s date I’d
> hazard a guess that the publication will be next year.
> XMSS/HSS is better suited for roots of trust and code signing (and
> possibly a few other limited cases, the NIST publication may give guidance
> here) where the environment where the signature is generated is tightly
> controlled.  I’d possibly support its use for limited end-entity
> certificates (the only semi-reasonable one I can think of is an EE cert
> with a private key in an HSM which is used to sign a TLS delegated
> credential of a different PQ or classical algorithm).
> The general SSH use case does not fit any tightly-controlled scenario like
> above, so I oppose adoption of this draft.

Any protocol where ordinary sysadmin tasks like restoring from backup or
running salt/Ansible/system de jour can cause a complete and total break of
security is unsuitable for a lot of servers. when used in SSH. Furthermore
PQ signatures aren't needed yet: you cannot retroactively attack
authorization they way you can encryption. I also oppose adoption.