Re: [openpgp] Recap of the signature options [was: PQC signature algorithm selection]

[Simon Josefsson <[e-mail]>]

Narrowing down options is good.  I think the options could be made more
clear if we discuss properties of the hybrid signature combiner scheme.
For background see https://eprint.iacr.org/2023/423.pdf and
https://datatracker.ietf.org/doc/html/draft-ietf-pquip-pqt-hybrid-terminology-02#section-5
on the WNS, SNS and SV terms.

I am reading in
https://datatracker.ietf.org/doc/html/draft-ietf-openpgp-pqc#name-composite-signatures
the following:

   4.3. Composite Signatures
   The ML-DSA + ECC signature consists of independent ML-DSA and ECC
   signatures, and an implementation MUST successfully validate both
   signatures to state that the ML-DSA + ECC signature is valid.

Some more details in
https://datatracker.ietf.org/doc/html/draft-ietf-openpgp-pqc#name-signature-verification
follows:

   To verify a ML-DSA + EdDSA signature the following sequence of operations has to be performed:
   Verify the EdDSA signature with EdDSA.Verify() from Section 6.1.1
   Verify the ML-DSA signature with ML-DSA.Verify() from Section 6.1.3

The signature value are formed as concatenation of component signatures,
quoting
https://datatracker.ietf.org/doc/html/draft-ietf-openpgp-pqc#name-signature-packet-tag-2
follows:

   The algorithm-specific v6 signature parameters for ML-DSA + EdDSA
   signatures consists of:
   - A fixed-length octet string representing the EdDSA signature, whose
   length depends on the algorithm ID as specified in Table 10.
   - A fixed-length octet string of the ML-DSA signature value, whose
   length depends on the algorithm ID as specified in Table 12.

The intention seems to achieve a SV property, am I reading this right?

I would feel more comfortable if PGP relied on a hybrid signature
combiner scheme that offered SV as a cryptographic property rather than
as a somewhat implicit protocol property.  And one that were specified
generally and not just for PGP.

One such scheme could be designed by replacing the two-part component
signature values with just one value that is:

   SHA3(Ed25519.signature
        || Ed25519.publickey
        || ML-DSA-87.signature
        || ML-DSA-87.publickey
        || context)

and the verifier has to compare the computed signature against that
value before being able to say ACK or NAK.

I may be missing something fundamental here, so a question: Are there
any fundamental reasons why a hybrid PQ/T signature scheme for PGP
cannot rely on a opaque signature combiner (like the one that I
suggested above, only better) that provides a SV guarantee?  Reversely:
is there any reason PGP must use the separable two-value approach in
section 6.3.1 of draft-ietf-openpgp-pqc?

/Simon