Re: [Secdispatch] Problem statement for post-quantum multi-algorithm PKI

[Stephen Farrell <[e-mail]>]

Hiya,

Just to be clear that is not my position.

On 17/09/2019 18:21, Michael Richardson wrote:
> 
> Encode ASN.1 in CBOR (CBOR encoding rules for ASN.1) if we think the ASN.1 is
> worth keeping, switch to CDDL if not.  We probably need to keep the semantics.

Seems like the semantics has to change with stateful signature schemes
with wall-clock time expiry is no longer appropriate for public keys.

Seems like the semantics has to change if N of M signatures must verify
compared to 1 of 1, esp if some alg may become "dubious" for say a
number of years before we find out that a break exists for that alg.
(The dubious alg may be due to a QC attack on a classic alg, or, and
maybe more likely, a classical attack on a new nad supposedly QC
resistant alg.)

Seems like existing x.509 libraries do not need to change, and nor
should they. We'd be breaking them horribly if we tried to retrofit
multiple algs/keys/sigs into x.509. Instead handle new things outside
x.509, so as to avoid introducing significant vulnerabilities into
what's now a more or less working system.

And I dispute the urgency for authentication. Long-lived devices that
cannot be updated in 20 years will be hugely vulnerable to things that
are nothing to do with quantum computers. It isn't worthwhile trying
to "fix" that now when it's too early to know what might or might not
be a good plan for dealing with authentication in a world that has a
working quantum computer - better to ensure those devices can be updated
and then do the best one can as needs arise. The probability of a
recall due to a vuln in a non-updatable device seems far higher than
anything else here.

Instead of all those bad plans - we should start to discuss what may
be needed for authentication in 20+ years time, part of which would be
quantum resistant algs. Another part may be an equivalent to CT which
turned out to be needed due to certificate mis-issuance, so the
discussion I'd be interested in wouldn't only be about quantum
computers. (But would overlap with that.)

Cheers,
S.