Re: [lamps] Call for adoption of draft-vangeest-x509-hash-sigs-03

[Adam Langley <[e-mail]>]

On Thu, Apr 11, 2019 at 11:31 AM Russ Housley <[e-mail]> wrote:
> We talked about the "Algorithm Identifiers for HSS and XMSS for Use in the Internet X.509 Public Key Infrastructure" <https://www.ietf.org/id/draft-vangeest-x509-hash-sigs-03.txt> document today dat the face-to-face meeting session.  It was suggested that the document is read for WG adoption.  Please voice your support or concerns on the list.

Since you're asking, my worries remain the same as outlined in
November[1] and thus I guess I'm "opposed", although that's a stronger
word that I would select.

There are firmware-signing contexts where size and verification speed
seem to preclude stateless signatures. There one may have to try and
invest in lots of infrastructure to manage the state. But such
contexts are also not using X.509 because of the same size concerns.

SPHINCS isn't an RFC, but it's perfectly sound as a basis for a
stateless signature scheme. (There are several, good, marginal
improvements in NIST submissions but they're not critical if rushing.)
I would go that route rather than throw a stateful primitive at
code-signing CAs and wishing them good luck.

[1] https://mailarchive.ietf.org/arch/msg/spasm/4EP3bX2adJBCmTjBMYazAKQJFU0


Cheers

AGL

--
Adam Langley [e-mail] https://www.imperialviolet.org