Re: [openpgp] PQC signature algorithm selection

[Falko Strenzke <[e-mail]>]

The current PQC draft also points out the purpose of multiple signatures 
for the purpose of backwards compatibility in Section 4.4 
<https://www.ietf.org/archive/id/draft-ietf-openpgp-pqc-00.html#multiple-signatures> 
as Daniel describes it.

Note also that the composite EdDSA+ML-DSA signatures have the feature of 
providing non-separability: It is not possible to remove one of the 
signatures to downgrade to a stand-alone signature of either of the two 
component schemes (since OpenPGP hashes the signature algorithm in the 
meta data). But when combining two non-composite signatures on the 
protocol level, either one can be stripped off.

I think useful signalling of the validity of multiple signatures will 
always remain difficult. On the one hand, one doesn't want to confuse 
the user with too much information. What should they conclude from one 
of two signatures being invalid or not interpretable?. On the other 
hand, in order to achieve long-term non-repudiation (to cover the 
failure of either the traditional or the PQC signature), the details 
need to be a checked or a proper policy needs to be in place. It seems 
to me that this is much easier to achieve with composites: simply check 
that there is one valid signature with EdDSA+ML-DSA.

One other important aspect to keep in mind in the discussion about 
non-composite signatures vs. composite signatures that Aron already 
pointed out (in the interim yesterday and also here in the discussion), 
is that in the non-composite case the primary key is either traditional 
or PQC and its subkey binding signatures are thus only strong as that 
single signature scheme. A composite primary EdDSA+ML-DSA key's 
signature is as strong as the strongest of the two signatures, obviously.

- Falko


Am 27.02.24 um 14:42 schrieb Daniel Huigens:
> On Tuesday, February 27th, 2024 at 14:19, Daniel Huigens wrote:
>> The benefit of combining it is that if ML-DSA is broken and Ed25519
>> isn't, the signature wouldn't be verified, even without updating the
>> receiving implementation.
> Sorry, I meant to say: ML-DSA being broken wouldn't cause a compromised
> signature to be verified. The (legitimate) Ed25519 and Ed25519+ML-DSA
> signatures would both still verify, of course.
>
> Conversely, if Ed25519 is broken, the Ed25519+ML-DSA would also continue
> to verify, even after Ed25519 was deprecated in the receiving
> implementation.
>
>
> So basically - having both an Ed25519 and an Ed25519+ML-DSA signature
> means that in the widest range of scenarios, the email is correctly
> considered valid or invalid:
>
> - MUAs that don't implement PQC can validate the Ed25519 signature
> - MUAs that do implement PQC can verify both
>    - If ML-DSA is broken and Ed25519 isn't, the attacker can't create a
>      compromised signature+message pair, even if the MUAs isn't updated
>    - If Ed25519 is broken and ML-DSA isn't, the MUA needs to be updated
>      to consider lone Ed25519 signatures invalid, but can continue to
>      verify Ed25519+ML-DSA signatures
>    - If both are broken, we need to switch to SLH-DSA :)
>
> Best,
> Daniel
>
> _______________________________________________
> openpgp mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/openpgp
-- 

*MTG AG*
Dr. Falko Strenzke
Executive System Architect

Phone: [phone]
E-Mail: [e-mail]
Web: mtg.de <https://www.mtg.de>

<https://www.linkedin.com/search/results/all/?fetchDeterministicClustersOnly=true&heroEntityKey=urn%3Ali%3Aorganization%3A13983133&keywords=mtg%20ag&origin=RICH_QUERY_SUGGESTION&position=0&searchId=d5bc71c3-97f7-4cae-83e7-e9e16d497dc2&sid=3S5&spellCorrectionEnabled=false>
Follow us
------------------------------------------------------------------------
<https://www.mtg.de/de/aktuelles/MTG-AG-erhaelt-Innovationspreis-des-Bundesverbands-IT-Sicherheit-e.V-00001.-TeleTrust/> 
<https://www.itsa365.de/de-de/companies/m/mtg-ag>

MTG AG - Dolivostr. 11 - 64293 Darmstadt, Germany
Commercial register: HRB 8901
Register Court: Amtsgericht Darmstadt
Management Board: Jürgen Ruf (CEO), Tamer Kemeröz
Chairman of the Supervisory Board: Dr. Thomas Milde

This email may contain confidential and/or privileged information. If 
you are not the correct recipient or have received this email in error,
please inform the sender immediately and delete this email.Unauthorised 
copying or distribution of this email is not permitted.

Data protection information: Privacy policy 
<https://www.mtg.de/en/privacy-policy>