Re: [lamps] [EXTERNAL] Re: Hybrid pkix isn't needed

[Mike Ounsworth <[e-mail]>]

>> Yet another is S/MIME email certificates: you need PQ CAs before you can issue PQ encryption certs.

>Why? There's nothing wrong with mixed algorithms in a chain. The bigger issue here is root program policies about what can be signed.

I don't follow. You're saying that we should issue post-quantum certificates off pre-quantum CAs?



> Hash based schemes are secure if any signature scheme is secure.

Maybe. I agree that HBS's are unlikely to yield algorithmic attacks, but they're just as likely as any other code to mess up an IF statement. If that's in the validation code then you have a problem (see the recent "psychic signatures" thing with ECDSA).

Hence the suggestion that *all* PQ algorithms should be used in some form of hybrid with battle-harneded ECDSA implementations.


> Even if we want to hybridize, having hybrid keys in certs seems a lot simpler to me than tying multiple certs through complex mechanisms.

Everyone seems to have a strong opinion on this, and nobody's opinions seem to line up. Some use cases will prefer multi-cert, some will prefer composite keys, some may even find migration benefits to using both together: multiple certs where one is composite. In my opinion, we are under-estimating how complicated PQ transitions will be, especially for the larger and more complex PKIs in the world. More available tools is a good thing.


---
Mike Ounsworth

-----Original Message-----
From: Spasm <[e-mail]> On Behalf Of Watson Ladd
Sent: Monday, January 30, 2023 1:20 PM
To: Seo Suchan <[e-mail]>
Cc: [e-mail]
Subject: [EXTERNAL] Re: [lamps] Hybrid pkix isn't needed

WARNING: This email originated outside of Entrust.
DO NOT CLICK links or attachments unless you trust the sender and know the content is safe.

______________________________________________________________________
On Mon, Jan 30, 2023 at 10:57 AM Seo Suchan <[e-mail]> wrote:
>
> Think there are two kinds of fail mode hybrid cert try to guard against:
> Quantum computer came out breaking classical asymmetrical crypto, or
> PQ algorithm we chooses was not that great and it broken down by new
> classical attack

Hash based schemes are secure if any signature scheme is secure. Even if we want to hybridize, having hybrid keys in certs seems a lot simpler to me than tying multiple certs through complex mechanisms.

Sincerely,
Watson Ladd


--
Astra mortemque praestare gradatim

_______________________________________________
Spasm mailing list
[e-mail]
https://urldefense.com/v3/__https://www.ietf.org/mailman/listinfo/spasm__;!!FJ-Y8qCqXTj2!fbHlvsGbpeRxQD89nneD-IbLn8xy29QgjYcb3jlsA-alvCwSee1kGDXWYq32siMT1rpBen_H1e2IjHGOlQ9khMb1wIiDAOg$
Any email and files/attachments transmitted with it are confidential and are intended solely for the use of the individual or entity to whom they are addressed. If this message has been sent to you in error, you must not copy, distribute or disclose of the information it contains. Please notify Entrust immediately and delete the message from your system.