[openpgp] Re: pure vs. pre-hash in FIPS 204 and 205

[Simo Sorce <[e-mail]>]

On Fri, 2024-08-30 at 15:59 +0000, Daniel Huigens wrote:
> Hi Simo,
> 
> On Friday, August 30th, 2024 at 17:16, Simo Sorce wrote:
> > I do not understand how you come to the conclusion I do not understand
> > the purpose of HashML-DSA given that purpose is clearly stated in
> > FIPS204.
> 
> Because you asked "What would be the point of doing that?" after I
> quoted FIPS 204 explaining the purpose of HashML-DSA.
> 
> The purpose clearly stated in Section 5.4 is to sign a message with an
> extra hashing step. That the extra hashing step can also be done
> elsewhere does not affect its primary purpose.
> 
> > Can you quote FIPS204 to substantiate this position? 
> 
> 
> I have quoted FIPS 204 multiple times, but will happily do so again.
> Section 5.4 says:
> 
>     In general, the “pure” ML-DSA version is preferred.
>     (...) If the content is not hashed at the application level, the
>     pre-hash version of ML-DSA signing may be used.
> 
> In other words, HashML-DSA is intended to be used in a specific case
> which does not apply to OpenPGP.

I am sorry, there is no point in going in circles, I think you
fundamentally misunderstand the purpose of HashML-DSA and I can't
reconcile your interpretation with the text, regardless of how many
times you quote select parts of it. Let's agree to disagree and end
this fruitless ping-pong here.

> 
> > I am not sure why you insist quoting this sentence.
> 
> I insist on quoting it because it contradicts your claim that FIPS 204
> recommends HashML-DSA :)
> 
> > YEs NIST prefers
> > Pure ML-DSA where possible, but "pure" Ml-DSA'a premise is tat you pass
> > the whole content you want to sign into it.
> 
> Where does FIPS 204 say that you're not allowed to sign a hash with
> pure ML-DSA?
> 
> > I quoted it literally to support my position.
> 
> The quotes you've provided describe something that is allowed, they
> say nothing about what is recommended. Could you please provide a
> quote that says that HashML-DSA is preferred for our use case, as
> you claim FIPS 204 says?
> 
> > So I think you misread the spec, and clearly you think I misread it.
> > Perhaps we bring the case to NIST and ask them what they think?
> 
> Falko already did so, and NIST have said that passing a hash to the
> pure variant is permissible. But yes, feel free to reach out to them
> if you think it needs further clarification, of course.

The response I read from David Cooper just said that because OpenPGP
structures its content in a way that would prevent substitution attacks
then pure ML-DSA signature would be protected from that attack.

I interpret that response as a judgment on the security of the solution
which I mentioned already I do not have a problem with. In fact he
opens the reply explicitly saying either could be used.

Simo.

-- 
Simo Sorce
Distinguished Engineer
RHEL Crypto Team
Red Hat, Inc