Re: [lamps] [EXTERNAL] Re: PQ-composite OR or K-of-N logic

[Mike Ounsworth <[e-mail]>]

Hi Panos and Michael,

Putting on my Editor hat -- just trying to see if I've understood this discussion correctly.

"Subset signatures" := when the signer uses only some of their component keys, and emits a "null signature" in place of the others.

This has been in the draft since draft-ounsworth-pq-composite-sigs-05 (July 2021). Currently this is " 3.4.1.  Composite-OR Legacy Mode" in sigs-06. This is the source of a lot of complexity and confusion in design discussions (for both composite signatures and composite content encryption).

Other than some handwaving about saving bandwidth, I don't think I've heard anyone say that this is actually useful, so I think at this point we can remove it from the draft and leave only signature and encryption modes where the signer / encryptor use all available keys.

Currently, draft-ounsworth-pq-composite-encryption-01 sections 2.2.1, 3.2.1, and 4.2.1 define Composite-OR as a subset algorithm, so we would need to change it there too.


"OR mode" := When listed in a public key / signature algorithm (draft-ounsworth-pq-composite-sigs-06 sections 3.2 and 3.3) it means that the verifier is allowed to pick its favourite signature from those provided and ignore the rest. When listed in a public key / encryption algorithm, it means ... what? that the CEK has been encrypted independently for each component key? (seems a bit redundant when used inside CMS)

QUESTION: Is there value in defining OIDs to specify OR mode in A) a public key, B) a signature algorithm, C) an encryption algorithm?



"K of N mode" := When listed in a public key / signature algorithm, it means that the verifier is allowed to pick its favourite k signatures from those provided and ignore the rest. When listed in a public key / encryption algorithm, it means ... what? that the CEK was encrypted under some sort of secret sharing scheme?

It seems like this IS NOT valuable for public key / signature algorithms, and should be left up to verifier local policy.

QUESTION: is that valuable for public key / encryption algorithm?

---
Mike Ounsworth

-----Original Message-----
From: Spasm <[e-mail]> On Behalf Of Michael Richardson
Sent: April 29, 2022 10:54 AM
To: Kampanakis, Panos <kpanos=[e-mail]>; Russ Housley <[e-mail]>; =?utf-8?B?IktsYXXDn25lciwgSmFuIg==?= <[e-mail]>; LAMPS <[e-mail]>
Subject: [EXTERNAL] Re: [lamps] PQ-composite OR or K-of-N logic

WARNING: This email originated outside of Entrust.
DO NOT CLICK links or attachments unless you trust the sender and know the content is safe.

______________________________________________________________________

Kampanakis, Panos <kpanos=[e-mail]> wrote:
    > That does not need the signer to define the k-of-n logic. The signer
    > will just create n signatures and put them in a composite one. The
    > verifier will verify k-of-n and pass verification. No need for
    > upgrades. And no need for the AND, OR, K-OF-N logic to be added in the
    > composite signature or public key to complicate things.

I agree, the value of k is probably Verifier policy.
The signer could express a hint via a policy OID, but ultimately, it's the verifier that needs to implement something.


--
Michael Richardson <[e-mail]>   . o O ( IPv6 IøT consulting )
           Sandelman Software Works Inc, Ottawa and Worldwide




Any email and files/attachments transmitted with it are confidential and are intended solely for the use of the individual or entity to whom they are addressed. If this message has been sent to you in error, you must not copy, distribute or disclose of the information it contains. Please notify Entrust immediately and delete the message from your system.