Re: [Secdispatch] Problem statement for post-quantum multi-algorithm PKI

[Mike Ounsworth <[e-mail]>]

As an author of a couple of the “hybrid” certificate drafts you mention, I can maybe add some context.

In the X.509 certificate space, we had been using the word “hybrid certificate” to refer to draft-truskovsky-lamps-pq-hybrid-x509. Since this is A) IP owned by ISARA, and B) ISARA has now branded this as an ISARA Catalyst Agile Digital Certificate, maybe that solves the problem of term-overloading.
https://www.isara.com/catalyst/

We have been using the term “composite certificate / signature” to refer to draft-ounsworth-pq-composite-sigs. If “composite” is going to become the most generic umbrella term, then perhaps we need to think of a new name to attach to this draft?

---
Mike Ounsworth
Software Security Architect, Entrust Datacard

From: Secdispatch <[e-mail]> On Behalf Of John Mattsson
Sent: Thursday, November 28, 2019 6:26 AM
To: Markku-Juhani O. Saarinen <[e-mail]>
Cc: [e-mail]
Subject: [EXTERNAL]Re: [Secdispatch] Problem statement for post-quantum multi-algorithm PKI

WARNING: This email originated outside of Entrust Datacard.
DO NOT CLICK links or attachments unless you trust the sender and know the content is safe.
________________________________
I would be fine with the word “composite” for both key establishment and signatures.

Another reason “dual” is not a good choice is that many of the suggested solutions allow more than two algorithms.

Hopefully NIST agrees and is happy to align on terminology together with IETF. As you point out they are also using multiple terms like “dual” and “hybrid”.

Cheers,
John

From: "Markku-Juhani O. Saarinen" <[e-mail]<mailto:[e-mail]>>
Date: Thursday, 28 November 2019 at 12:18
To: John Mattsson <[e-mail]<mailto:[e-mail]>>
Cc: "[e-mail]<mailto:[e-mail]>" <[e-mail]<mailto:[e-mail]>>
Subject: Re: [Secdispatch] Problem statement for post-quantum multi-algorithm PKI

Hi,

Agree that Hybrid should be PKE/KEM + DEM. That's what I learned in school and that's what cryptography textbooks have said for decades (although the current KEM/DEM terminology is newer).

Note that to add to the confusion, NIST discusses "dual signatures" (not to be confused with 1990's SET "dual signatures") in their proposed amendment to the NIST PQC FAQ.

Dustin Moody (NIST), October 30: "Is it possible for a dual signature to be validated according to FIPS 140?" https://groups.google.com/a/list.nist.gov/d/msg/pqc-forum/qRP63ucWIgs/rY5Sr_52AAAJ<https://protect2.fireeye.com/v1/url?k=8fe20097-d368ca49-8fe2400c-86823e270a62-85c0287cf0a1d721&q=1&e=31172618-1e53-4018-8f88-e1d064ebe0f8&u=https%3A%2F%2Fgroups.google.com%2Fa%2Flist.nist.gov%2Fd%2Fmsg%2Fpqc-forum%2FqRP63ucWIgs%2FrY5Sr_52AAAJ>

Sadly his key-establishment is still "hybrid". Hopefully we can change this.

A quick poll in this particular office seems to favour the word "composite" for both key establishment and signatures.

Cheers,
- markku

Dr. Markku-Juhani O. Saarinen <[e-mail]<mailto:[e-mail]>> PQShield, Oxford UK.


On Thu, Nov 28, 2019 at 10:41 AM John Mattsson <john.mattsson=[e-mail]<mailto:[e-mail]>> wrote:
Hi,

There are now two very different use cases of the word 'hybrid' being discussed in IRTF/IETF.

Combination of KEM + DEM:

https://tools.ietf.org/html/draft-irtf-cfrg-hpke

Combination of multiple algorithms of the same type (KEM or Signature)

https://tools.ietf.org/html/draft-tjhai-ipsecme-hybrid-qske-ikev2
https://tools.ietf.org/html/draft-stebila-tls-hybrid-design
https://tools.ietf.org/html/draft-campagna-tls-bike-sike-hybrid
https://tools.ietf.org/html/draft-pq-pkix-problem-statement
https://tools.ietf.org/html/draft-truskovsky-lamps-pq-hybrid-x509
https://tools.ietf.org/html/draft-ounsworth-pq-composite-sigs

I would suggest that IRTF/IETF do not use the word 'hybrid' for both of these different meanings. Given that 'hybrid' is quite established for the combination of KEM + DEM

https://en.wikipedia.org/wiki/Hybrid_cryptosystem

and the use of 'hybrid' for PQC is quite new and not yet that established, I would suggest that IRTF/IETF use 'hybrid' for KEM + DEM and agree on another term for the PQC use cases. 'multiple-algorithms' and 'composite' has been mentioned in documents and discussions. I would be fine with both of these. 'Multiple encryption' seem to be the most common term for encrypting with several algorithms.

https://en.wikipedia.org/wiki/Multiple_encryption

Cheers,
John


_______________________________________________
Secdispatch mailing list
[e-mail]<mailto:[e-mail]>
https://www.ietf.org/mailman/listinfo/secdispatch