Re: [lamps] Call for Adoption of draft-ounsworth-pq-composite-sigs

[Hubert Kario <[e-mail]>]

On Wednesday, 17 April 2024 15:59:50 CEST, Kampanakis, Panos wrote:
> I oppose adoption as well. 
>
> Some of the reasons: 
> - Combining sigs is not as urgent of an issue, so we better 
> have trust to whatever we deploy before we need them.
> - We can afford to wait for most signing use-cases, and those 
> that can't, can use SLH-DSA which is conservatively secure. 
> - Classical  and PQ sigs will coexist for a long time so any PQ 
> signature security issue could be remediated by swapping back to 
> classical. 

To add to that, signatures that need to remain secure for a long
period of time (legal documents and such) can already use multiple
time-stamps to prove using both classical and post-quantum crypto
that the original classical signature was created before
cryptographically relevant quantum computers were created.

So, in my opinion, it's too early to work on composite signatures.

> -----Original Message-----
> From: Spasm <[e-mail]> On Behalf Of Stephen Farrell
> Sent: Wednesday, April 17, 2024 9:21 AM
> To: Russ Housley <[e-mail]>; LAMPS <[e-mail]>
> Subject: RE: [EXTERNAL] [lamps] Call for Adoption of 
> draft-ounsworth-pq-composite-sigs
>
> CAUTION: This email originated from outside of the 
> organization. Do not click links or open attachments unless you 
> can confirm the sender and know the content is safe.
>
>
>
> Hiya,
>
> On 16/04/2024 19:29, Russ Housley wrote:
>> At IETF 119, there was a short discussion of 
>> draft-ounsworth-pq-composite-sigs.  The authors asked for a call for 
>> adoption, and no one offered any reason not to move forward at that 
>> time.
>> 
>> This message starts a two-week call for adoption of this document.
>> Please say whether you support adoption of this document by Tuesday,
>> 30 April 2024.
>
> (Perhaps unsurprisingly;-) I oppose adoption.
>
> I don't think we have a sufficient understanding of the costs 
> of adding composite sigs to x.509 based PKIs, and how those 
> costs will be distributed amongst the various parties involved, 
> nor about what's likely or unlikely to be deployed, to fire 
> ahead now and define a pile of new composite sig algs. To do 
> proper engineering, we should IMO have such an understanding 
> before we start spraying out new OIDs each of which imposes 
> costs on participants in PKIs.
>
> Cheers,
> S.
>
> PS: I could also raise objections about lower level details of 
> the draft but those could perhaps be handled after adoption, 
> e.g. whether, and if so what kinds of, RSA sigs to include 
> shouldn't be based on what's possible but on what's likely to 
> get adopted esp. by real CAs, relying parties and key holders.
>
>

-- 
Regards,
Hubert Kario
Principal Quality Engineer, RHEL Crypto team
Web: www.cz.redhat.com
Red Hat Czech s.r.o., Purkyňova 115, 612 00, Brno, Czech Republic