Re: [saag] ASN.1 vs. DER Encoding

[Nico Williams <[e-mail]>]

On Wed, Mar 27, 2019 at 12:36:06AM +0100, Dr. Pala wrote:
> Back to be serious... At the end of this thread, you ask "/why build a new
> one/" ?

I agree we need new encoding rules.  I'm skeptical that we need new
syntax.

> I think, but there might be other reasons I am not aware of, that the main
> argument was to save few hundreds bytes per certificate [...]

Yes, that's one reason to need new encoding rules.

(Though OER should fit the bill, but I understand that's not likely to
happen, so I won't mention it again.)

> .... and this consideration reminds me about an observation that I have not
> brought up during the meeting, but I should have: the current trend in
> cryptography seems to be oriented towards the need to use larger structures
> (signatures and keys) to cryptographically authenticate data (e.g.,
> certificates, etc.). I think that ECC was a pleasant aberration from this
> point of view that made everybody think we discovered gold - same or
> increased security at a fraction of the price! That is great - and we are
> all very happy we can now use a quite efficient crypto-systems like ECC.
> However, I think, things are going to change: most of the quantum-resistant
> algorithms come with increased signature and/or key sizes (up to 40K for
> signatures in some cases) or with new usage paradigms (stateful keys) that
> are not trivial to handle.

Sure.  Encoding efficiency is not a great motivator for new encoding
rules for PKIX.  It is for Kerberos though.

>                                 [...]. However, my fear is that people will
> start to feel "comfortable" with the idea that the size of authentication
> data is very small and will start designing systems that do not take in
> consideration the envisioned evolution of crypto algorithms... leading to
> some inevitable disaster down the road.

We can always push the PK to edges of the system and use symmetrically-
keyed tokens elsewhere.  Needham-Schroeder is post-quantum by dint of
being symmetrically keyed, but that also keeps it from scaling to
Internet scale.  An automatic, PK-based federation system can always be
added, and then use PQ PK to get a fully PQ system that scales up and
also amortizes the transmission and compute cost of the PQ PK.

(Otherwise I'm actually not fond of Kerberos, or Needham-Schroeder.  The
one nice thing about Kerberos is not needing CRLs/OCSP, and that's
easily accomplished in PKIX with online CAs that vend short-lived, fresh
certificates.)

> In this view, maybe pushing for such an herculean effort to save few hundred
> bytes per certificate might come with costs so high (in terms of the needed
> changes to support the new format(s)) that would not justify its deployment,
> IMHO.

Yes.

Nico
--