Re: [lamps] [EXTERNAL] Re: LAMPS Re-charter

[Daniel Kahn Gillmor <[e-mail]>]

On Wed 2021-03-24 12:53:28 -0400, Michael Richardson wrote:
> Daniel Kahn Gillmor <[e-mail]> wrote:
>     > PQ-hybrid signatures are a much easier thing to tackle than PQ-hybrid
>     > encryption.  But PQ-hybrid encryption is also the thing that has the
>     > most urgency.  Signature verification has an out: verifiers can
>     > time-bound their acceptance of legacy signatures once a quantum-based
>     > cryptanalytic attack becomes known to be plausible.
>
> Do you mean that a verifier can say, "I'll accept your legacy signature as
> long as it's less than 2hr old"
> ("2hr" being the time I think it takes for a PQ to be mounted).

The time-bound i was thinking of was:

 - If a quantum-based cryptanalytic attack becomes feasible on a given
   algorithm at time T, then a verifier can still re-validate any
   signatures that arrived (that is, that the verifier has had a copy
   of, or that is visible in some robust historic ledger) prior to time
   T.  That is, old, pre-existing signatures are not automatically
   invalidated by a new quantum attack.  Note that this is *not* the
   case for encrypted material -- old, pre-existing encryption
   protection can indeed be invalidated by a new quantum attack.

The scenario I think you're describing does seem like it might be
potentially useful, but only in the context of defending against a very
specific kind of attack, with very specific protocol expectations.

In particular, if we learn of a quantum-based cryptanalytic attack that
weakens an existing signature system by allowing the production of a
signature (with some remaining non-negligible workfactor), but *without*
permitting private key recovery from public key material, then:

 - the legacy scheme could still be useful in contexts where "freshness"
   of signatures can be detected. For example, in a time-bounded
   challenge-response protocol (verifier sends signer a challenge,
   signer produces signature over a message that includes that challenge
   in a predetermined way), or a key-agreement protocol (e.g. in modern
   TLS) where both parties contribute to the underlying ephemeral
   established secret, and then one or both parties sign the secret to
   prove identity to the other.

I don't know enough about the field of possible quantum attacks to know
whether this latter situation is a plausible scenario.  Certainly if the
quantum attack permits private key recovery from public key material,
then the time bounds described above are meaningless, beceause the
private key could be derived offline, in advance of the protocol
exchange, and then the private key could be used directly with no
additional delay.

        --dkg