Re: [Curdle] call for adoption for draft-mu-curdle-ssh-xmss-00

[Watson Ladd <[e-mail]>]

On Thu, Nov 21, 2019 at 9:44 PM Daniel Van Geest <[e-mail]>
wrote:

> NIST will issue a special publication on stateful hash-based signatures
> before the rest of the PQ process completes.  Based on today’s date I’d
> hazard a guess that the publication will be next year.
>
>
>
> XMSS/HSS is better suited for roots of trust and code signing (and
> possibly a few other limited cases, the NIST publication may give guidance
> here) where the environment where the signature is generated is tightly
> controlled.  I’d possibly support its use for limited end-entity
> certificates (the only semi-reasonable one I can think of is an EE cert
> with a private key in an HSM which is used to sign a TLS delegated
> credential of a different PQ or classical algorithm).
>
>
>
> The general SSH use case does not fit any tightly-controlled scenario like
> above, so I oppose adoption of this draft.
>

Any protocol where ordinary sysadmin tasks like restoring from backup or
running salt/Ansible/system de jour can cause a complete and total break of
security is unsuitable for a lot of servers. when used in SSH. Furthermore
PQ signatures aren't needed yet: you cannot retroactively attack
authorization they way you can encryption. I also oppose adoption.