IETF Logo Mail Archive

[lamps] Can ML-DSA be used in CMS?

Mike Ounsworth <Mike.Ounsworth@entrust.com> Tue, 13 February 2024 13:36 UTC

Return-Path: <Mike.Ounsworth@entrust.com>
X-Original-To: spasm@ietfa.amsl.com
Delivered-To: spasm@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E615EC13AE21; Tue, 13 Feb 2024 05:36:48 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.105
X-Spam-Level:
X-Spam-Status: No, score=-2.105 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_MESSAGE=0.001, RCVD_IN_ZEN_BLOCKED_OPENDNS=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, T_SCC_BODY_TEXT_LINE=-0.01, URIBL_BLOCKED=0.001, URIBL_DBL_BLOCKED_OPENDNS=0.001, URIBL_ZEN_BLOCKED_OPENDNS=0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=entrust.com
Received: from mail.ietf.org ([50.223.129.194]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id wFFAiy6R8h1E; Tue, 13 Feb 2024 05:36:43 -0800 (PST)
Received: from mx07-0015a003.pphosted.com (mx07-0015a003.pphosted.com [185.132.183.227]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B1A95C14CF1C; Tue, 13 Feb 2024 05:36:42 -0800 (PST)
Received: from pps.filterd (m0242864.ppops.net [127.0.0.1]) by mx08-0015a003.pphosted.com (8.17.1.24/8.17.1.24) with ESMTP id 41D6ciCe014224; Tue, 13 Feb 2024 07:36:40 -0600
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=entrust.com; h= from:to:cc:subject:date:message-id:content-type:mime-version; s= mail1; bh=7IybWtlsG/lARXzSMeJrxGfxA5JQGh4dhmBPSFWR4ek=; b=nA2Wjj 0uoO9D+AqZRHtgPuke0zx9A/0LwGO1uCm3D1DZgi5dgWH2g0OPAJQ4KLkU7nmP/O xhBXYBA0Qri2l8oSFRHKeVu24LFJ3Vks9mhfqv55qjmlEb2VhQIlrz4yk8t2e7G7 gNJKqn8ZVY1T7KWNiplh6wpmHfuZlMMSCIVYhEuSXru4lDeniWBwbcF8x3O2T8CE ftyXzj96JSdj6OaVHzT25BDDolQn/rrbgMsBSNsBdec7dPeDU7s3D7TaOKG7PK7R npWAOanuYJiKTid/W7RgOVSBTZrT1qlXeKtVuGEqcVEHmGnpeavpND7LG8BYxReT NWLyR1IoO4NB1ETg==
Received: from nam11-bn8-obe.outbound.protection.outlook.com (mail-bn8nam11lp2169.outbound.protection.outlook.com [104.47.58.169]) by mx08-0015a003.pphosted.com (PPS) with ESMTPS id 3w66q3fmge-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Tue, 13 Feb 2024 07:36:40 -0600 (CST)
ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=dmmVDPoVpFgh/vbdvQv9ttZW7HFJYg+zAXGQStmR6dC8Drt3gnIQoMVDcTgEyxi8YSUGF5MecRImiAD23CPGmRLh0rX9hG6Vayd9/fj53qHo45uELsv13SFPGn06eGBIWjaMYsknooKdcnfAz6Z6CBh6/qKk6y07tWGaUdx7DBAX35c+M2HTdL+lZQ2cNozjiqDmQFgCmlqkKLkcu96MCXtx2P/4dlVbjeH+ilo8tqg4UwGkQdS3JqUgw+9hxv69A4EPq0Nv3A9XW6isLSWGtHk2JGqiBa8zWPJ2QxziIGbxGe7yYV9iVjJRPtYm6U0iUshbZe5F2EYIUUkDXWGXsw==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=7IybWtlsG/lARXzSMeJrxGfxA5JQGh4dhmBPSFWR4ek=; b=JOFHzXgIBI2BTeyN2xdRwHRybFYOibCKo0OrD105myGgKPR+hZfYh6jylvhCdFVeRAmGAr3Lg42NaTrzJv/ErJL13kmR0E98FTQ1Uf1zak7mlSkLYwFGQoe271PIev1YJtziZta9h5fIt+qeOI4/XpRmaByuzl+tqtYFG5BfboJlF3PcKvNxzzJLXXsOZjDj6kBqnR534dfdpTo69I9CVyKU7F4DdSsPPBLgWVptHpfuNj4f/0TWDkFDZGMqSbHYgyfcemI53fCpRxv5KWmg7GaQqlJ/bKKr36I0nxdWkEGJsXovsW4Pi0XsIhwiauBHYBQbDfvu9fJtV+YI4983XQ==
ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=entrust.com; dmarc=pass action=none header.from=entrust.com; dkim=pass header.d=entrust.com; arc=none
Received: from CH0PR11MB5739.namprd11.prod.outlook.com (2603:10b6:610:100::20) by DS7PR11MB7950.namprd11.prod.outlook.com (2603:10b6:8:e0::18) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.7270.34; Tue, 13 Feb 2024 13:36:36 +0000
Received: from CH0PR11MB5739.namprd11.prod.outlook.com ([fe80::d401:ba56:87f2:7eb8]) by CH0PR11MB5739.namprd11.prod.outlook.com ([fe80::d401:ba56:87f2:7eb8%6]) with mapi id 15.20.7270.033; Tue, 13 Feb 2024 13:36:36 +0000
From: Mike Ounsworth <Mike.Ounsworth@entrust.com>
To: "draft-ietf-lamps-dilithium-certificates@ietf.org" <draft-ietf-lamps-dilithium-certificates@ietf.org>
CC: 'LAMPS' <spasm@ietf.org>
Thread-Topic: Can ML-DSA be used in CMS?
Thread-Index: AdpegWJS6kfqw04TR4e1AUBBNJk9wg==
Date: Tue, 13 Feb 2024 13:36:36 +0000
Message-ID: <CH0PR11MB5739AF8408E1669FB9EF912A9F4F2@CH0PR11MB5739.namprd11.prod.outlook.com>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach: yes
X-MS-TNEF-Correlator:
x-ms-publictraffictype: Email
x-ms-traffictypediagnostic: CH0PR11MB5739:EE_|DS7PR11MB7950:EE_
x-ms-office365-filtering-correlation-id: bc4c0ada-5f57-4492-bf45-08dc2c98ccfb
x-ms-exchange-senderadcheck: 1
x-ms-exchange-antispam-relay: 0
x-microsoft-antispam: BCL:0;
x-microsoft-antispam-message-info: 0rYc7pzf1RImVo5MbQJu5Jj3oWnXfdYTVdnK+txsX3JZaNY0uttIeDuzwYjD3y3U38mq+0NJY3w8dGCcdXHIc6o4F4jGwhEjqy7J0bh3XTvudC33jI3bO/M5Naq8YmqCCwqMe2iHKN5huQ1ic33eABuUFxY2V1O2emPP5fxUP8EalCh09YmFtx3OPvanoI1kic6ay0ueQmgpiTkxyt5DfuKTuJgLHoqgeqev9+AnYbKGO6Fw+EJIAQsU8dV+a4ccdk4iU3lFdNPneRlgVUn6q5cDXpX4I7vvAwt0xcv4vD8CzFp1ktvSge01aek865HSl7jYMWicW5NTdzoVrzw2By82Zyf+dWWxN1on9voD3UQ+LHtn5hbL33xxfJnXm2q7bX0nRnKc41CfEGqU+HFJmhQs9rIT7/JkDHSv9bxNKrqEXBkgTCa8xxhaD2j9K73RBowCtmd5ciq02uL9B0Iwuaw5Axbq6LS9NX8LIYbf7g35w3wz8DcpeSDKs9wu+UzO4kiYrdq5mVhyllGPQirFNAVz3FE32Y1C9EbAUIXrhJIvINoMqmDYIiQmllc37L7qcotxfUoua9cMQP+iiaYd03CGQ5xz22wPAokEHwVB/8QV6kebeLI0qqlyJYqAlKTp
x-forefront-antispam-report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:CH0PR11MB5739.namprd11.prod.outlook.com; PTR:; CAT:NONE; SFS:(13230031)(136003)(376002)(396003)(346002)(366004)(39850400004)(230922051799003)(64100799003)(1800799012)(186009)(451199024)(66946007)(66476007)(76116006)(8936002)(71200400001)(66556008)(4326008)(6506007)(9686003)(316002)(7696005)(52536014)(6916009)(64756008)(66446008)(99936003)(8676002)(122000001)(450100002)(38100700002)(26005)(86362001)(41300700001)(83380400001)(38070700009)(33656002)(478600001)(4744005)(2906002)(55016003)(5660300002); DIR:OUT; SFP:1102;
x-ms-exchange-antispam-messagedata-chunkcount: 1
x-ms-exchange-antispam-messagedata-0: aEfERqOWXL8QSWcX4a929V/zAQjVPivipz11gNX76geUPNkAUmtorbbxBx5Im/PoRxjKCyMbsyMT1lbn9h8793Qaf0dsryBZKaNnwYy5BAaIfcEGohoxTbL5NJk5xAvk31svG/8MxVghdtuP7Axu5P1yKGZm129ivrU2Ordf3clMqqlzZsGHq3YRGu5tc+PogFFCTT8PeJvq1nmwGr7DR9i9ZGpC80MQRwzv03dFSP5m6L8//NsOOJNHwxsHhKx4egVBG3cytVjOC03FNl38nPlAYKCFNg6wacua0LDubVewv+GrnkMmhovnU7TBqViDS3e1ES2eF88mFH/VKr05V3kYeaX/F8xczPkBQuRLzS4VUkecvQWMpaK+WxqNGSIq+FAZDpZJDgd8ySGbzegAKlAJIb5C0bVMIGxX/pjJtQh9+0GLczpMLAUy5t+f5eNIAR+rylY82TACJiIqxaXmgwD3s4YFs26dAvskEP6MnuTRWBSmx6y7t8fKTCf/keeJBFlKLVxjlVSzxRTQcftE4PSZUJNCq3KAhrkP3nZl/79VCJdyeDY/lEqTCZaiFkUtrzzk5D2x08S6+L/89ahtDvpUVjT26K5gA8iWTkWz/mV2Bao4EU0fp/cP1MY0wxz5021rDqZ0oguJZjH8F+Paprcb5Ovz1ofID+3Xe2OQQskXLB3gtH/GmNpUrgU4vKY9ndtY0Om5SoRYIHq45qzZB887XUyRoWuUIeXMgjHz0WhH6oaczdlP1sGUQ0JpvVXYkjAL2pw7iQ1s2epk7iOYvnIHpUMPk40oUbrERaFJwN11Ct+7lPQX4De7jHtou96WYGm2lXnYqY1QNs8e49pWBY5pYNwCnHZ/m1h6E9XGmlKk9YoFtCJ7f6IcOC/50945sSG71ksU/HeM94UgJenygtqZGOjd6gbaDiUiVMLTgnPg9ykbvkHgacH9ZhM5zIcsNtKYh0N7Sh2iO0hV2iXqDbGW74k6s43lrtBlIYK+Z1rl+Rr9/tW/fbWF4HJx1D2H6tRWrOSsmg5M3DuaUiuTI7cPBIHBcWUZIZkRKnMEpd4+qhrlgdM5GL7cyplICYfK4l02yLRLmo3Y18AQ2td+pFxciveoy8YXlnJ+jzNcfbKxaWKZHj6w69Qk8o7AYq0xtQke8hXrr/gzU5GwWf2c68kYTteMRaColY9txpobOf2dVlsi62nb+olJjT2+PnPsMRJXgpgZzgAm45uD1p37ydGChJRJaAZ5F/4tLqb2SmNjtsHRLlBB4fKJ95ooo4m9YROQ/sOQKj1wl1vgqJjBK3MWMRkcH2jBLrenZjnuiglp52jDiJil+lS2iQQTyKV+heVsDipXjjXigKlNtOBF/FSmlG4Nl6p8cJdaxTOP1sUCt9H6LvL0TRZ3Xc0CpScX4lEkpIojKQtviU8BsQ6p3VDaZH0F8eua5DO9BM/RFy0ACtlVvuy+4UAEVwGZz8AgxwUaMegMUpTXCG6OStD/w/pUOG1bC0aa0x7O6X2RtfIt2ygAWhNlbYCxCynvys6Lnw2AgOa3dbj80M7TqJZnz4UN+KGkP9HE6IV5iFRRstLdk5Y79Zw2RRgdzh+tv/EH
Content-Type: multipart/signed; protocol="application/x-pkcs7-signature"; micalg="SHA1"; boundary="----=_NextPart_000_085E_01DA5E4F.5F27C480"
MIME-Version: 1.0
X-OriginatorOrg: entrust.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-AuthSource: CH0PR11MB5739.namprd11.prod.outlook.com
X-MS-Exchange-CrossTenant-Network-Message-Id: bc4c0ada-5f57-4492-bf45-08dc2c98ccfb
X-MS-Exchange-CrossTenant-originalarrivaltime: 13 Feb 2024 13:36:36.5431 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: f46cf439-27ef-4acf-a800-15072bb7ddc1
X-MS-Exchange-CrossTenant-mailboxtype: HOSTED
X-MS-Exchange-CrossTenant-userprincipalname: 3gcZ3pjt08Ge66qzHUTXoC+5Wsoocw9HybvmALI4cyquXrgmjo+8jammvAp6OZahvqVjKXZkiGh3j5ygUiE8QwwwAsBgpl6CswSAlmXcC04=
X-MS-Exchange-Transport-CrossTenantHeadersStamped: DS7PR11MB7950
X-Proofpoint-ORIG-GUID: 7QQqQnZS67usSKt_mEap57IQWceX5ek8
X-Proofpoint-GUID: 7QQqQnZS67usSKt_mEap57IQWceX5ek8
X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.272,Aquarius:18.0.1011,Hydra:6.0.619,FMLib:17.11.176.26 definitions=2024-02-13_07,2024-02-12_03,2023-05-22_02
X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=1 lowpriorityscore=0 phishscore=0 clxscore=1011 suspectscore=0 adultscore=0 malwarescore=0 impostorscore=0 priorityscore=1501 bulkscore=0 mlxscore=1 mlxlogscore=196 spamscore=1 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.19.0-2401310000 definitions=main-2402130108
Archived-At: <https://mailarchive.ietf.org/arch/msg/spasm/KwjXVY8sbs6kLhvb5KokM36xpuI>
Subject: [lamps] Can ML-DSA be used in CMS?
X-BeenThere: spasm@ietf.org
X-Mailman-Version: 2.1.39
Precedence: list
List-Id: This is the mail list for the LAMPS Working Group <spasm.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/spasm>, <mailto:spasm-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/spasm/>
List-Post: <mailto:spasm@ietf.org>
List-Help: <mailto:spasm-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/spasm>, <mailto:spasm-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 13 Feb 2024 13:36:49 -0000

The answer obviously is Yes, but draft-ietf-lamps-dilithium-certificates
does not actually say this.

 

I was reading a draft ICAO ePassport document yesterday that correctly
points out that IETF has a draft for how to use ML-DSA into X.509
certificates, but no draft for how to use ML-DSA in CMS.

 

Authors of draft-ietf-lamps-dilithium-certificates, if you add a section
"Signed-data Conventions" modelled after RFC8419, then I think that saves us
from needing a whole second ML-DSA draft.

 

---
Mike Ounsworth
Software Security Architect, Entrust

v2.23.0 | Report a Bug | By Email