[lamps] Re: [EXTERNAL] Re: Re: WG Last Call: draft-ietf-lamps-pq-composite-sigs-08 (Ends 2025-10-06)

[John Mattsson <[e-mail]>]

Mike Ounsworth wrote:

>Hi John and Ilari,
>
>>In short, using hybrids in anything needing SUF-CMA is Bad Idea.
> +1
>
>This feedback is not helpful. I understand clearly that you are unhappy with the text. I do >not understand what modification to the text you would like to see.

The text from Ilari is a very concrete example of the kind of text that is severely needed in the draft. You could add it directly but you would need to change it to:

"using the hybrids in this draft in anything needing SUF-CMA is Bad Idea."

As this is _not_ true for hybrid signatures in general.

Mike Ounsworth wrote:
>We can't get the draft out the door because we're waiting for someone to
>propose updated wording for EUF / SUF.

The major technical and marketing problems with this draft and EUF / SUF was pointed out a very long time ago. Since then nothing has happened. The security properties of the EdDSA hybrids were reduced from -05 to -06.

Cheers,
John

From: Mike Ounsworth <[e-mail]>
Date: Saturday, 4 October 2025 at 21:16
To: John Mattsson <john.mattsson=[e-mail]>
Cc: Ilari Liusvaara <[e-mail]>, [e-mail] <[e-mail]>
Subject: [lamps] Re: [EXTERNAL] Re: Re: WG Last Call: draft-ietf-lamps-pq-composite-sigs-08 (Ends 2025-10-06)
Hi John and Ilari,

>>In short, using hybrids in anything needing SUF-CMA is Bad Idea.
> +1

This feedback is not helpful. I understand clearly that you are unhappy with the text. I do not understand what modification to the text you would like to see.
Would adjusting a sentence to say "SUF ... unless one component has its SUF property broken, in which case it reduces to EUF" suffice?


On Fri, 3 Oct 2025 at 11:23, John Mattsson <john.mattsson=[e-mail]<mailto:[e-mail]>> wrote:
>In short, using hybrids in anything needing SUF-CMA is Bad Idea.

+1

From: Ilari Liusvaara <[e-mail]<mailto:[e-mail]>>
Date: Friday, 3 October 2025 at 18:19
To: [e-mail]<mailto:[e-mail]> <[e-mail]<mailto:[e-mail]>>
Subject: [lamps] Re: [EXTERNAL] Re: Re: WG Last Call: draft-ietf-lamps-pq-composite-sigs-08 (Ends 2025-10-06)
On Thu, Oct 02, 2025 at 06:04:09PM -0500, Mike Ounsworth wrote:
> Hi all -- particularly @Peter C <[e-mail]<mailto:[e-mail]>> , @John Mattsson
> <[e-mail]<mailto:[e-mail]>> , @Bas Westerbaan <[e-mail]<mailto:[e-mail]>>
>
> I have taken another pass over the EUF / SUF security considerations.
>
> https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2Flamps-wg%2Fdraft-composite-sigs%2Fpull%2F288&data=05%7C02%7Cjohn.mattsson%40ericsson.com%7C91330c59da4a4743146d08de0298afe8%7C92e84cebfbfd47abbe52080c6b87953f%7C0%7C0%7C638951051977336759%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&sdata=d%2BuLs4cJKQaxAP5T7YcTZExQCrRWmsTqlfyaY7DXoIo%3D&reserved=0<https://github.com/lamps-wg/draft-composite-sigs/pull/288>
>
> I expect this will not fully satisfy John and Bas, but I'm hoping that we
> are closing in on compromise that can pass WGLC. Please comment on that PR;
> I am hoping to get this merged and a new WGLC version published in the next
> day or so.

I am not happy about the text.

The text seems to recommend using ML-DSA + EdDSA combination for
applications requiring SUF-CMA. And eariler text seems to suggest that
the adversary has to break both algorithms to break security.

However, either algorithm breaking ruins SUF-CMA, and since the
application needs it, this ruins security.

In short, using hybrids in anything needing SUF-CMA is Bad Idea.




-Ilari

_______________________________________________
Spasm mailing list -- [e-mail]<mailto:[e-mail]>
To unsubscribe send an email to [e-mail]<mailto:[e-mail]>
_______________________________________________
Spasm mailing list -- [e-mail]<mailto:[e-mail]>
To unsubscribe send an email to [e-mail]<mailto:[e-mail]>