Re: [lamps] Proposed addition of hash-based signature algorithms for certificates to the LAMPS charter

[Adam Langley <[e-mail]>]

On Sat, Nov 10, 2018 at 2:35 AM Dr. Pala <[e-mail]> wrote:

> long time no see... are you still on this mailing list ? Are you planning
> to contribute to the working group ? Anyhow, to the technical matter...
>
(I was pointed to thread this by a colleague.)

> I do not understand your position here. The draft is just about defining
> the OIDs, the RFC for the Hash-based signatures is defined elsewhere and I
> think is progressing in its definition and use (e.g.,
> draft-mcgrew-hash-sigs-13, ietf-lamps-cms-hash-sig, etc.), therefore I do
> not think that these objections are relevant for the document at hand.
>
> Can you please provide more *targeted notes about this particular
> document ?*
>
The document mentioned by Russ at the top of the thread
is draft-vangeest-x509-hash-sigs-01. Its title says that it's specifically
about HSS and XMSS, and it continues: "[the] private keys are stateful".

> P.S.: For the point you are raising about stateful schemes are mostly true
> - they are more difficult to handle and we will need to modify interfaces
> and APIs (e.g. PKCS#11) to add the possibility to transfer/update the
> private key status, however this is something we shall prepare to do since
> many QR algorithms tend to be stateful, IMHO. In this sense, stateful
> schemes are (most probably) going to be relevant in many environments.
> Maybe not in browsers, but, as I always try to remind people, browsers !=
> Internet and TLS != PKI (therefore, it might not be relevant to you, but
> they might be relevant in many other environments - e.g., Cable Industry,
> Wireless, etc.). Just my 2 cents...
>
There was been a general, and positive, move over the past decade+ towards
cryptographic primitives that are more robust, e.g. giving people AEADs
rather than a hash and block cipher and telling them to figure it out. I
think the general use of stateful signatures would be counter to this and a
mistake. I don't believe that many QR algorithms are stateful: it's just
the small signatures as far as I'm aware. Stateful hash-based signatures
are useful, but as building blocks of a stateless system.


Cheers

AGL