Re: [Secdispatch] Problem statement for post-quantum multi-algorithm PKI

[Michael Richardson <[e-mail]>]

Stephen Farrell <[e-mail]> wrote:
    > On 14/09/2019 03:19, Michael Richardson wrote:
    >> 
    >> > One might think we have plenty of time, given that Real Quantum >
    >> Computers are, more than likely, more than 10 years away, and even
    >> once > you have one, you cannot use your Quantum Computer to break the
    >> > authentication of recorded conversations.
    >> 
    >> No, we really don't have plenty of time.  Some suggest that it is
    >> actually already rather *late*
    >> 
    >> Long-lived devices (such as automobiles) are being designed today, for
    >> production in mid-2020s, and many will be on the road until 2040.

    > Count me unconvinced.

    > Either those devices will have s/w update or they're screwed already

If QM mechanisms take a lot more ram or a lot more bandwidth, then
software updates aren't going to help them.
My understanding is that safety critical systems in cars are authenticating
to each other over the internal buses (CAN, etc.) already.

    > even without requiring the putative existence of a quantum
    > computer. And we are discussing authentication here, mostly of origins
    > I guess, and not confidentiality, so post-facto attacks don't count
    > afaics.

    > I'd appreciate if someone could explain the specifics of the pressing
    > issue here that requires us to not wait for e.g., the outcome of the
    > NIST competition.

I'm not saying that we can't wait to finalize things.
I'm saying that we shouldn't wait for it to be finalized to start.

Can we support multiple signatures inside a certificate? I don't think so.
So what can we do?

-- 
]               Never tell me the odds!                 | ipv6 mesh networks [ 
]   Michael Richardson, Sandelman Software Works        | network architect  [ 
]     [e-mail]  http://www.sandelman.ca/        |   ruby on rails    [