Re: [lamps] Hybrid pkix isn't needed

[Ilari Liusvaara <[e-mail]>]

On Sun, Jan 29, 2023 at 03:43:15PM -0800, Watson Ladd wrote:
> 
> I don't think linking certs or special provisions for hybrid
> encryption or authentication are a good idea.  A hybrid encryption
> scheme should be an encryption scheme with a public and private key,
> just like any other key you can put in the PKIX.
> 
> If for backwards compatibility you want to have multiple kinds of keys
> just like we do with RSA and ECDSA keys in TLS, just do that! Don't
> add complexities to try to link them or force people to find both keys
> at once for an operation. We know that the transition model with
> multiple unrelated certs works, and we have experience and fixed bugs
> that resulted. Let's use that instead of have new bugs to fix.

Furthermore, in context of TLS, linking certificates is a non-starter.
The TLS chain rules just plain do not allow that (even the more flexible
TLS 1.3 ones), because there is a fundamential limitation of one end-
entity certificate.

And I consider the TLS 1.3 chain rules to be too complex (paraphrasing,
TLS 1.2 has chain of trust, TLS 1.3 has spaghetti of doubt). Linked
certificates are much much worse. I consider the complexity to be
absolutely terrifying.

And standards doing complex stuff absolutely does matter. E.g., the
recent OpenSSL security issue was ultimately caused by unnecressary
complexity in standards (having to match two fields with very
different encodings).



-Ilari