Re: [saag] post-X509 cryptographic identities

[Eric Rescorla <[e-mail]>]

On Tue, Feb 11, 2020 at 5:09 PM Stephen Farrell <[e-mail]>
wrote:

>
>
> On 12/02/2020 00:51, Eric Rescorla wrote:
> > Well, I see what you say at the end, but I don't understand it. In TLS
> 1.3,
> > key establishment does not involve the cert, which is used for
> > authentication.
>
> Sure. And in a PQ world one might worry about factorisation
> and propose unwise changes to x.509 that involve >1 alg in
> the certificate signature and SPKI fields. My main point is
> that I think that'd be unwise. (Not so much because of TLS
> details, but more because of x.509 library details.)
>
> It'd be similarly unwise to want to try handle public keys
> for PQC KEMs via x.509 and given the entire world is not
> yet on TLS1.3, that'd maybe still be a bit of an issue.
>

Well, I don't think there is going to be much enthusiasm for adding PQ to
TLS 1.2, but even if there was, you would most likely do it the same way as
in 1.3, as a new DH "group"

-Ekr

Cheers,
> S.
>