Re: [lamps] [EXTERNAL] Re: LAMPS Virtual Interim in Sept. 2022

[Mike Ounsworth <[e-mail]>]

+ CFRG as this is request for crypto security review


Sorry for the late reply,

Could I get a slot at the LAMPS interim to discuss the hash-then-sign issue for Dilithium and Falcon?



Issue summary:

- Needing to stream your entire message to your crypto module is dumb (think streaming an entire firmware image to your network HSM for code-signing, or to your TPM for secure boot validation; yuck).
- You want to send just a hash.
- Both Dilithium and Falcon have, as their first internal step' a hash of the message prepended with a nonce (the pubkey for Dilithium, and a random r for Falcon), I assume in order to block pre-computed collision attacks.
- If you, for example, do SHA256(m) before calling Dilithium.sign(), then you have re-introduced that collision attack.
- You can externalize that first hashing step of the Dilithium / Falcon sign / verify algs outside of the crypto module without breaking interop, but doing so will need to be mentioned in the standards, and will need security review.

---
Mike Ounsworth

-----Original Message-----
From: Spasm <[e-mail]> On Behalf Of Russ Housley
Sent: September 8, 2022 3:21 PM
To: LAMPS <[e-mail]>
Cc: Tim Hollebeek <[e-mail]>
Subject: [EXTERNAL] Re: [lamps] LAMPS Virtual Interim in Sept. 2022

WARNING: This email originated outside of Entrust.
DO NOT CLICK links or attachments unless you trust the sender and know the content is safe.

______________________________________________________________________
A few things for tomorrow have come up, which prevented us from picking that date.  So, we care going to hold the LAMPS Virtual Interim on 19 Sept. 2022 at 9:00 Eastern.

We already have two agenda items.  Please let us know if you want to present on another topic.

Russ & Tim


> On Aug 24, 2022, at 12:07 PM, Russ Housley <[e-mail]> wrote:
>
> Two agenda topics did not get covered at IETF 114:
> - draft-perret-prat-lamps-cms-pq-kem
> - draft-kario-pkcs12-pbmac1
>
> There may be other topics that have progressed enough to need some discussion.
>
> Tim and I think that 60 minutes will be enough to to cover these topics.
>
> Please fill out the following poll to help us find the best time for the meeting:
> https://urldefense.com/v3/__https://doodle.com/meeting/participate/id/dN9x14vb__;!!FJ-Y8qCqXTj2!ZDZM1GgJw-UNsq7N5jg8dUYx470A6dFZyNqiwQrJRoRhH73AH0b35-Kl0QnYNyJLmi_5VMh0JJP1FOEFWwmtfYwZA0K4$
>
> Russ & Tim
>
>
> _______________________________________________
> Spasm mailing list
> [e-mail]
> https://urldefense.com/v3/__https://www.ietf.org/mailman/listinfo/spasm__;!!FJ-Y8qCqXTj2!ZDZM1GgJw-UNsq7N5jg8dUYx470A6dFZyNqiwQrJRoRhH73AH0b35-Kl0QnYNyJLmi_5VMh0JJP1FOEFWwmtfZyACGq2$

_______________________________________________
Spasm mailing list
[e-mail]
https://urldefense.com/v3/__https://www.ietf.org/mailman/listinfo/spasm__;!!FJ-Y8qCqXTj2!ZDZM1GgJw-UNsq7N5jg8dUYx470A6dFZyNqiwQrJRoRhH73AH0b35-Kl0QnYNyJLmi_5VMh0JJP1FOEFWwmtfZyACGq2$
Any email and files/attachments transmitted with it are confidential and are intended solely for the use of the individual or entity to whom they are addressed. If this message has been sent to you in error, you must not copy, distribute or disclose of the information it contains. Please notify Entrust immediately and delete the message from your system.