[Secdispatch] Quantum Resiliant

[Phillip Hallam-Baker <[e-mail]>]

We have a lot of interest in building PKI architectures that are secure
against quantum cryptanalysis. I see three different levels at which this
can be achieved.

Class 1: The system uses a quantum cryptanalysis secure public key
algorithm that provides all the same capabilities as traditional public key
algorithms.

Class 2: The system uses symmetric key based security with a significant
impact on capabilities as it is only possible to establish trust after
first establishing a shared secret. (e.g. Kerberos, Lamport signatures).

Class 3: The system is a traditional PKI modified to mitigate the
consequences of quantum cryptanalysis without modifications that
significantly affect traditional use. (e.g. use of hash chain notary to
protect signatures, use of shared secret KDF mixins).

As a field, we have to explore all three. And it might well be that the
short term interest is in the last. For protocol designers like myself, the
class 1 is not an interesting problem and won't be until we know how
quantum resistant public key algorithms differ from traditional PKI. We are
assuming that the problem is solved without the need for any protocol
re-engineering or with minor tweaks.

Class 2 presents some very interesting challenges as Lamport signatures are
statefull so we need a way to manage the state. Another approach that could
be interesting is to attempt a federated version of Kerberos. CAs become
Kerberos ticket granters.

So lets say I am trying to contact Amazon.com, I do this using a ticket I
have acquired from TicketCo which has a shared ticket with both of us.
Easy! OK, but how do I establish that shared ticket? Well I am going to
have to meet each CA in person or rely on some sort of federated
introduction infrastructure and we end up with multiple inputs to KDFs or
Shamir secret sharing and the like.

Class 3 looks like it is the least interesting but it is the new
'constrained device' case for PKI and that makes it a fascinating challenge
as you have to provide as much quantum security in the context of
traditional PKI approaches.