Re: [lamps] Call for adoption for the composite-related Internet-Drafts

[Ilari Liusvaara <[e-mail]>]

On Tue, May 30, 2023 at 03:42:54PM -0400, Russ Housley wrote:
> Should the LAMPS WG adopt these three Internet-Drafts ...
> 
> 1) "Composite Signatures For Use In Internet PKI" in draft-ounsworth-pq-composite-sigs-09?

No.

Any work on this is premature until NIST publishes the NISTPQC
specifications. The transition long pole can not even begin before that
point, and all that would likely result from this draft is zombie
algorithms causing problems.

If some application requires very long-term security, it should be
using non-hybrid hash signatures. That is actually why NSA published the
very premature CNSA 2.0 specification with major missing references.


> 2) "Composite Public and Private Keys For Use In Internet PKI" in draft-ounsworth-pq-composite-keys-05?

No.

The key formats should be simple enough to define in the KEM / signature
specifications. Any sort of common "framework" is a major red flag about
excessive complexity that will lead into security bugs.

 
> 3) "Composite KEM For Use In Internet PKI" in draft-ounsworth-pq-composite-kem-02?

No.

While KEMs are much more time-critical, so one could justify the effort
before NISTQPC specifications are available, this draft does not seem to
be even a good starting point.

It adopts predefined table approach (which I think is acceptable as it
does not involve ciphersuites) but then all data formats seem to assume
generic composition, leading to excessive complexity that is just asking
for security bugs. Fixing this seems to amount to pretty much total
redesign (not that it would be complicated).




-Ilari