Re: [lamps] Hybrid pkix isn't needed

[Ilari Liusvaara <[e-mail]>]

On Mon, Jan 30, 2023 at 02:46:50PM +0900, Tadahiko Ito wrote:
> 2023年1月30日(月) 8:43 Watson Ladd <[e-mail]>:
> 
> >
> > I don't think linking certs or special provisions for hybrid
> > encryption or authentication are a good idea.  A hybrid encryption
> > scheme should be an encryption scheme with a public and private key,
> > just like any other key you can put in the PKIX.
> >
> > Authentication breaks are not retroactive:
> Could you clarify if signing purposes ( code-signing, and OCSP signing,
> time-stamping, etc.) is outside the scope of your comment or not.

Well, the comment said "encryption or authentication" (and also talked
about "ECDSA"), so presumably "authentication" mainly refers to signing.

And OCSP signing is very different from code-signing or time-stamping.


> I am not sure if we need bonded certs or hybrid cert for those use-cases,
> but it might be better to have some mechanisms for those use-cases.

Well, for code-signing or time-stamping, I don't think either of those
works very well:

- Bonded certs are extremely complicated.
- Hybrid certs need to be backward-compatible for depoloyment reasons,
  which requires very nasty hacks.

The simplest is probably multiple independent signatures, assuming
whatever system actually supports that.



-Ilari