Re: [openpgp] PQC signature algorithm selection

[Simon Josefsson <[e-mail]>]

Thanks for summarizing - I agree with the BaSFN approach.

Daniel Kahn Gillmor <[e-mail]> writes:

> The conclusion i've reached here is what i'd call
> "belt-and-suspenders-for-now" (BaSFN).  That is, i think we should just
> define a composite ML-DSA+EdDSA scheme (perhaps allocating two
> codepoints so that we can have two levels so folks can make a single
> binary strength/performance tradeoff) and leave the application-level
> semantics intact as though the composite scheme is an entirely new
> signing scheme.

Here is my only disagreement with your discussion and conclusions,
assuming I understand what you meant here - please don't pick two
different security levels.  Doing so generally leads to parametrized
implementations with worse performance, more complexity, harder audits
and as a result less security.  Instead, pick sufficient secure
parameters and hedge the choices on different algorithms.

Select two hybrid signature schemes as MUST algorithms by selecting one
trusted non-PQ algorithm such as

ECDSA-P256
ECDSA-P384
ECDSA-P512
Ed25519
Ed448

and combine it with one currently popular PQ algorithm like

ML-DSA-65
ML-DSA-87
SLH-DSA-SHAKE

I suggested ML-DSA-87 + Ed25519 and SLH-DSA-SHAKE256 + Ed25519 as the
two MUST choices before, and this still seems consistent with the above.

If the NIST crowd insists on ML-DSA-87 + ECDSA-P384, or BSI crowd
insists on ML-DSA-87 + brainpoolP384, those can easily go into a
separate draft on MAY level.

/Simon