Re: [Secdispatch] [EXTERNAL]Re: Clarification Question for the Comment from Eric Rescorla (

[Stephen Farrell <[e-mail]>]

Hiya,

On 12/12/2019 16:32, Panos Kampanakis (pkampana) wrote:
> Hi,
> 
>> Sorry if I've missed it, but who do we have that is calling for a
>> post-quantum PKI solution to be developed now, but who is not
>> promoting one such?
> 
> We (Cisco) will need PQ PKI (not WebPKI) solution for image signing.
> When talking about chips that are designed now and will live in the
> field for decades, we would like to design today instead of wait for
> 2030. 

Thanks. It's not at all clear to me that data integrity nor
origin authentication in that timeframe ought be tied to
x.509 certificates at all. (Except for legacy algs/keys
where there's nothing to do.) Or do you envisage using other
approaches instead or as well when you say PKI? Personally,
I'd guess some kind of manifest based approach would be
better, maybe starting from cose or something. I would
be supportive of exploratory work in that space.

But adding multiple key/alg combinations alongside classical
algs/keys into x.509 certificates would create so many new
failure modes for all libraries that handle x.509 that it
seems generally unwise to me. (The failure modes for such
libraries have always been horrible, making 'em worse is
not a plan I'd warm to;-)

> Note we are spending (not making) money on PKI, so we are not
> trying to corner a market.

Fair enough that "corner a market" was a bit pejorative.
Apologies for that.

I'm just not at all convinced that trying to define how
to handle PQ algorithms in x.509 is at all worthwhile
now, especially before we have an outcome from the NIST
competition. Once we do have a standard set of algorithms
that people want to use (bearing in mind how sha-3 has
not set the world alight) then defining OIDs for those
would be fine, and fairly straightforward, but starting
now down a path that leads to x.509 certificates that
contain combinations of keys/algs in one cert seems like
a terrible plan to me.

Cheers,
S.

> I have talked to another vendor interested in them to sign its OS but
> I will not speak for them. I have also talked to at least one HSM
> vendor that has some clients asking for PQ PKI support to be added in
> their HSM but I will not speak for them either. I don't think any of
> these use-cases are trying to corner a market.
> 
> Panos
> 
> 
> -----Original Message----- From: Secdispatch
> <[e-mail]> On Behalf Of Stephen Farrell Sent:
> Sunday, December 08, 2019 9:04 PM To: Mike Ounsworth
> <[e-mail]>; Eric Rescorla <[e-mail]>;
> Dr. Pala <[e-mail]> Cc: IETF SecDispatch
> <[e-mail]> Subject: Re: [Secdispatch] [EXTERNAL]Re:
> Clarification Question for the Comment from Eric Rescorla (
> 
> 
> Hiya,
> 
> Cutting to the nub of my concern...
> 
> On 09/12/2019 01:46, Mike Ounsworth wrote:
>> I hope that doesn’t preclude a push for a more immediate solution.
> 
> ISTM the "push" is less for a solution than for understandably
> attempting to corner a market. I don't think such attempts are "bad"
> things, but I do think following 'em is more likely unwise.
> 
> Sorry if I've missed it, but who do we have that is calling for a
> post-quantum PKI solution to be developed now, but who is not
> promoting one such?
> 
> Thanks, S. _______________________________________________ 
> Secdispatch mailing list [e-mail] 
> https://www.ietf.org/mailman/listinfo/secdispatch
>