[lamps] A Mechanism for Encoding Differences in Paired Certificates ("Chameleon Certificates")

[Corey Bonnell <[e-mail]>]

Hello,
At the Hackathon at IETF 116 this March, several participants implemented the "Hybrid Catalyst" certificate extension processing initially documented in https://datatracker.ietf.org/doc/html/draft-truskovsky-lamps-pq-hybrid-x509-01<https://urldefense.com/v3/__https:/datatracker.ietf.org/doc/html/draft-truskovsky-lamps-pq-hybrid-x509-01__;!!FJ-Y8qCqXTj2!cVtZTmw5ofb7exW867tO1Dt4OX0FfRBXz3O4C7v8wqq2YU3w2jns1Cbv4RmGRJX9A50mtfKasgkkRiskmWZKMM5093s$> and later standardized in ITU-T X.509 10/2019. This implementation experience led several of us to explore alternative mechanisms to efficiently convey multiple keys and other attributes in a single X.509 certificate. The product of these discussions is the specification a mechanism informally called "Chameleon Certificates" at https://datatracker.ietf.org/doc/draft-bonnell-lamps-chameleon-certs/<https://urldefense.com/v3/__https:/datatracker.ietf.org/doc/draft-bonnell-lamps-chameleon-certs/__;!!FJ-Y8qCqXTj2!cVtZTmw5ofb7exW867tO1Dt4OX0FfRBXz3O4C7v8wqq2YU3w2jns1Cbv4RmGRJX9A50mtfKasgkkRiskmWZKD2A_ZP4$>. The mechanism that we developed allows for the differences between two related certificates to be encoded in a single extension within one of the certificates. Relying parties can then extract the other certificate using the information found in the extension.

The primary use case in mind is algorithm migration, in particular post-quantum algorithm migration. However, the mechanism can also be applied to other use cases, such as efficiently encoding a signing certificate and encryption certificate in one X.509 certificate.

Several folks are already planning to work on implementing this draft at the IETF 117 Hackathon, but we'd like to circulate this draft to this group for initial thoughts.

Thanks,
Corey on behalf of the authors