Re: [lamps] Proposed addition of hash-based signature algorithms for certificates to the LAMPS charter

On Mon, Nov 12, 2018 at 9:35 AM Tim Hollebeek <tim.hollebeek@digicert.com>
wrote:

> (chair hat off)
>
>
>
> Reconstituting a CT log server from a backup is similarly catastrophic.
>

Could you elaborate on why you believe that’s relevant? I have some
suspicions, but before I point out the flaws in an argument you may not be
making, it seems useful to understand exactly what connection you see
between that and a discussion of certificate signing algorithms.

The risk you note is certainly something that should be carefully addressed
> in the draft, but I think throwing stateful signatures out of IETF entirely
> because of it is a bit of an overreaction.
>

That’s fairly dismissive, even if couched in “a bit”. Do you disagree that
the stateless signatures offer equivalent security and with better
usability than stateful signatures - something that other WGs have been
prioritizing or requiring of their work product for half a decade now? What
makes this WG unique?

>
> -Tim
>
>
>
> *From:* Spasm <spasm-bounces@ietf.org> *On Behalf Of *Adam Langley
> *Sent:* Thursday, November 8, 2018 12:42 PM
> *To:* Russ Housley <housley@vigilsec.com>
> *Cc:* SPASM <spasm@ietf.org>
> *Subject:* Re: [lamps] Proposed addition of hash-based signature
> algorithms for certificates to the LAMPS charter
>
>
>
> On Tue, Nov 6, 2018 at 7:51 PM Russ Housley <housley@vigilsec.com> wrote:
>
> The SECDISPATCH WG met on Tuesday afternoon, and they made this
> recommendation:
>
> >  draft-vangeest-x509-hash-sigs-01 -- re-charter LAMPS WG to accept this
> draft
>
> Three questions:
>
> 1) Do you support the addition of this work to the LAMPS charter?
>
>
>
> No:
>
>
>
> The signature schemes in the draft are stateful and sudden-death: the
> penalty for mishandling the state is huge. This contrasts with every
> signature scheme ever (I believe) deployed and thus with every current
> process. For example, reconstituting an HSM from smartcards would be a
> fatal error with such a scheme.
>
>
>
> These schemes hedge against a valid risk, but at the cost of introducing a
> much larger one.
>
>
>
> The contexts in which stateful & sudden-death signatures are plausible are
> so specific and controlled that standisation in X.509 would be immaterial
> to them—they are not multi-lateral enough that whether something has an RFC
> or not matters. On the other hand, standisation implicitly hints that the
> thing being standardised is somewhat reasonable. So, on balance, I don't
> think the integration of stateful schemes into formats and protocols is a
> suitable subject for the IETF.
>
>
>
>
>
> AGL
>
> --
>
> Adam Langley agl@imperialviolet.org https://www.imperialviolet.org
> _______________________________________________
> Spasm mailing list
> Spasm@ietf.org
> https://www.ietf.org/mailman/listinfo/spasm
>