Re: [Rats] Quantum-safe attestation

[Michael Richardson <[e-mail]>]

Laurence Lundblade <[e-mail]> wrote:
    > We probably want RATS architecture to be able to use quantum-safe
    > algorithms. On low cost and low speed devices that might mean HMAC is
    > used since SHA-2 and such seem to be quantum-safe. On higher cost and
    > higher speed devices there may be alternatives that look more like
    > PKI.

Yes/no.

Use of a keyed HMAC requires a symmetric key, which will be a hassle to
provision the verifier, and effectively locks the device to a single (likely
manufacturer provided) verifier.   It will also raise questions of
non-repudiation.
Better *might* be RFC8778 HSS/LMS Hash-Based Signature Algorithms.
They are bigger, and have a limited number of uses.

I would say that the architecture does not need to say anything about the
algorithms.  These are functional requirements, not design requirements.

There will have to be firmware updates to the Attesting Environment once
either we have quantum-safe asymmetric algorithms, or when we have a QM
breach.  That can be done with SUIT signed by RFC8778.
I don't think that our architecture need worry about that.

--
Michael Richardson <[e-mail]>, Sandelman Software Works
 -= IPv6 IoT consulting =-