Re: [lamps] [EXTERNAL] Re: draft-ounsworth-pq-composite-sigs-11

[Mike Ounsworth <[e-mail]>]

> Thanks. Can you point me a which of the 72 pages address the issue at hand? (I may discover it myself but quicker to point at it if you already know where the answer to my question can be found.)

As I quoted in my proposed I-D text change below, the best direct quote is:

"Therefore, quantum computer-resistant methods should
not be used alone - at least in a transitional period - but
only in hybrid mode, i.e. in combination with a classical
method. For this purpose, protocols must be modified
or supplemented accordingly. In addition, public key
infrastructures, for example, must also be adapted"

You will also want to look at "Section 3.4 X.509 certificates" which specifically references this I-D.


> That's about QKD. How is that relevant?

Because it includes this quote, which I included in my proposed I-D text change below.

“In light of the urgent need to stop relying only on quantum-vulnerable public-key cryptography for key establishment, the clear priority should therefore be the migration to post-quantum cryptography in hybrid solutions”



> Because so far it's merely an assertion of need via an argument from authority.

Yes. Is that not what you asked for?
The BSI document spells out why this is wanted for X.509 certificates. 
What more is missing for this to be an acceptable argument to you?
Do I need to spell out that there exist things in the world which use X.509?

---
Mike Ounsworth

-----Original Message-----
From: Stephen Farrell <[e-mail]> 
Sent: Thursday, February 8, 2024 12:51 PM
To: Mike Ounsworth <[e-mail]>; Kris Kwiatkowski <[e-mail]>; [e-mail]
Subject: Re: [EXTERNAL] Re: [lamps] draft-ounsworth-pq-composite-sigs-11


Hiya,

On 08/02/2024 18:42, Mike Ounsworth wrote:
>> I'm not currently being a detractor. I'm asking for someone to document a case where these hybrid signing algorithms are needed and needed now. If that's not doable then I find that fairly telling.
> 
> The BSI has documented it. Here is their document:
> https://www.bsi.bund.de/SharedDocs/Downloads/EN/BSI/Publications/Broch
> ure/quantum-safe-cryptography.pdf

Thanks. Can you point me a which of the 72 pages address the issue at hand? (I may discover it myself but quicker to point at it if you already know where the answer to my question can be found.)

> The French Cybersecurity Agency (ANSSI), Federal Office for 
> Information Security (BSI), Netherlands National Communications Security Agency (NLNCSA), and Swedish National Communications Security Authority, Swedish Armed Forces have documented it. Here is their document:
> https://cyber.gouv.fr/sites/default/files/document/Quantum_Key_Distrib
> ution_Position_Paper.pdf

That's about QKD. How is that relevant?

> I am unclear why you don't accept this as proof-of-need.

Because so far it's merely an assertion of need via an argument from authority.

> 
> I am also unclear why proof-of-need is a requirement for RFC publication. 

I never mentioned RFC publication.

> Are you trying to tell me that the IETF has never once published an RFC that didn't end up getting used in production? There is a government recommendation document specifically citing this I-D as an example of "good". Surely that is enough by itself to meet the IETF's bar for usefulness.
> 
> I have seen NSA documents (I'm thinking of draft-ietf-lamps-cert-binding-for-multi-auth) be adopted with a justification that boils down to "DoD wants this for internal use". That is less justification than we have for composite sigs, yet somehow that was acceptable, and this is not?
> 

I don't recall that document.

If your argument in the end turns out to be "we want to do this because someone wants it, but we can't explain why it's needed (and needed now)"
then that's an outcome of sorts for this discussion I guess. But not a particularly convincing one, I'm sure you'd agree.

S.


> ---
> Mike Ounsworth
> 
> -----Original Message-----
> From: Stephen Farrell <[e-mail]>
> Sent: Thursday, February 8, 2024 12:32 PM
> To: Mike Ounsworth <[e-mail]>; Kris Kwiatkowski 
> <[e-mail]>; [e-mail]
> Subject: Re: [EXTERNAL] Re: [lamps] 
> draft-ounsworth-pq-composite-sigs-11
> 
> 
> Hiya,
> 
> On 08/02/2024 18:26, Mike Ounsworth wrote:
>> Hi Stephen,
>>
>>> Other agencies have recommended against hybrid KEMs by times, and we happily ignore that.
>>
>> I fully disagree. We are not ignoring that at all.
>> LAMPS has draft-ietf-lamps-kyber which instructs how to use Kyber by itself in CMS, which fulfills the requirements from people who do not want hybrids. And similarly draft-ietf-lamps-dilithium-certificates for pure Dilithium signatures.
>> My understanding is that the IETF does not play politics; if multiple governments have conflicting technical requirements, then we should produce separate mechanism to satisfy each. It is clear to me that there exists a need for this motivated by BSI and ANSSI recommendations. Full stop.
>>
>>
>> I have written some text into the composite signatures draft that I think addresses this. It is currently on a github pull request:
>>
>> https://github.com/EntrustCorporation/draft-ounsworth-composite-sigs/
>> p
>> ull/131
>>
>> It adds the following text to the Introduction:
>>
>> + In particular, certain jurisdictions are recommending or requiring that PQC lattice schemes only be used within in a PQ/T hybrid. As an example, we point to [BSI2021] which includes the following recommendation:
>>
>> + "Therefore, quantum computer-resistant methods should not be used 
>> + alone - at least in a transitional period - but only in hybrid 
>> + mode, i.e. in combination with a classical method. For this 
>> + purpose, protocols must be modified or supplemented accordingly. In 
>> + addition, public key infrastructures, for example, must also be adapted"
>>
>> + In addition, [BSI2021] specifically references this specification as a concrete example of hybrid X.509 certificates.
>>
>> + A more recent example is [ANSSI2024], a document co-authored by 
>> + French Cybersecurity Agency (ANSSI), Federal Office for Information 
>> + Security (BSI), Netherlands National Communications Security Agency (NLNCSA), and Swedish National Communications Security Authority, Swedish Armed Forces which makes the following statement:
>>
>> + “In light of the urgent need to stop relying only on quantum-vulnerable public-key cryptography for key establishment, the clear priority should therefore be the migration to post-quantum cryptography in hybrid solutions”
>>
>> + This specification represents the straightforward implementation of the hybrid solutions called for by European cyber security agencies.
>>
> 
> That's about the closest I've ever seen to a pure argument from authority. I don't think we ought base IETF work on such a well known fallacy.
> 
>>
>> To flip the burden of proof back onto the detractors:
> 
> I'm not currently being a detractor. I'm asking for someone to document a case where these hybrid signing algorithms are needed and needed now. If that's not doable then I find that fairly telling.
> 
> S.
> 
> 
>> if you think that this work should not proceed, then please justify why the IETF does not need to produce a mechanism to fulfil this recommendation from multiple governments. Or perhaps the IETF already has a mechanism that satisfies this requirement, but if so, I am not aware of one -- for example all of the Multi-Cert mechanisms that I am aware of operate in an OR mode, and are therefore not "hybrids" as defined in the above-referenced BSI recommendations document.
>>
>> ---
>> Mike Ounsworth
>>
>> -----Original Message-----
>> From: Stephen Farrell <[e-mail]>
>> Sent: Thursday, February 8, 2024 12:00 PM
>> To: Mike Ounsworth <[e-mail]>; Kris Kwiatkowski 
>> <[e-mail]>; [e-mail]
>> Subject: Re: [EXTERNAL] Re: [lamps]
>> draft-ounsworth-pq-composite-sigs-11
>>
>>
>> Hiya,
>>
>> On 08/02/2024 15:31, Mike Ounsworth wrote:
>>> Not to be flippant, but I think the answer is "everywhere".
>>
>> You may be unsurprised to hear that I disagree.
>>
>>> The current recommendations (at least from some European 
>>> governments) are to not use lattice schemes in isolation, but only 
>>> in hybrids. So anywhere that uses long-term keys (ex.: certs for 
>>> CAs, S/MIME, Code Signing, Document Signing, any-other-thing 
>>> Signing, etc) and wants to migrate to Dilithium *should* migrate to 
>>> a dilithium+ecc or
>>> dilithium+rsa composite.
>>>
>>> Would it address your comment if we add text to the Intro to that 
>>> effect that references the various government calls for hybrids?
>>
>> Not for me, no. Other agencies have recommended against hybrid KEMs by times, and we happily ignore that. We should also be doing the engineering work to determine what's needed where and when. So I think we need a demonstration that these kinds of hybrid signing algs are needed, and needed now. I've not seen that myself, especially in a context where pq signing algs seem to be evolving a lot.
>>
>> S.
>>
>>>
>>> --- Mike Ounsworth
>>>
>>> -----Original Message----- From: Spasm <[e-mail]> On 
>>> Behalf Of Stephen Farrell Sent: Wednesday, February 7, 2024 4:25 PM
>>> To: Kris Kwiatkowski <[e-mail]>; [e-mail] Subject:
>>> [EXTERNAL] Re: [lamps] draft-ounsworth-pq-composite-sigs-11
>>>
>>>
>>> Hiya,
>>>
>>> On 07/02/2024 22:07, Kris Kwiatkowski wrote:
>>>> * Is there a document describing real-world use cases for this draft?
>>>> I’m aware of draft-vaira-pquip-pqc-use-cases, but really I’m 
>>>> looking for use cases where draft-ounsworth-pq-composite-sigs will 
>>>> be clearly very useful/necessary to have.
>>>
>>> I'd also be v. interested in that, and didn't find such text when I 
>>> looked a few months back. (And I think such text is very much
>>> needed.)
>>>
>>> Cheers, S.