Re: [lamps] [EXTERNAL] Re: LAMPS Re-charter

[Mike Ounsworth <[e-mail]>]

@dkg it sounds a bit like you're hinting at timestamping servers (or their modern equivalent: blockchains and merkle trees).

I wonder if CT logs have the "time-bounded" property you're looking for: any certs indexed into the CT Merkle tree before the "quantum apocalypse" can still be trusted (the cert itself - DN, SANs, etc - can still be trusted; the keys inside it may well be compromised). Though the things getting CT-logged (public web certs) are only valid for ~ 1 year, so they'd likely be expired by the time you care to look back.

---
Mike Ounsworth

-----Original Message-----
From: Spasm <[e-mail]> On Behalf Of Michael Richardson
Sent: March 25, 2021 9:50 AM
To: Daniel Kahn Gillmor <[e-mail]>
Cc: LAMPS <[e-mail]>; Russ Housley <[e-mail]>; Mike Ounsworth <Mike.Ounsworth=[e-mail]>; Rene Struik <[e-mail]>
Subject: Re: [lamps] [EXTERNAL] Re: LAMPS Re-charter


Daniel Kahn Gillmor <[e-mail]> wrote:
    >> Daniel Kahn Gillmor <[e-mail]> wrote:
    >> > PQ-hybrid signatures are a much easier thing to tackle than PQ-hybrid
    >> > encryption.  But PQ-hybrid encryption is also the thing that has the
    >> > most urgency.  Signature verification has an out: verifiers can
    >> > time-bound their acceptance of legacy signatures once a quantum-based
    >> > cryptanalytic attack becomes known to be plausible.
    >>
    >> Do you mean that a verifier can say, "I'll accept your legacy signature as
    >> long as it's less than 2hr old"
    >> ("2hr" being the time I think it takes for a PQ to be mounted).

    > The time-bound i was thinking of was:

    > - If a quantum-based cryptanalytic attack becomes feasible on a given
    > algorithm at time T, then a verifier can still re-validate any
    > signatures that arrived (that is, that the verifier has had a copy
    > of, or that is visible in some robust historic ledger) prior to time
    > T.  That is, old, pre-existing signatures are not automatically
    > invalidated by a new quantum attack.  Note that this is *not* the
    > case for encrypted material -- old, pre-existing encryption
    > protection can indeed be invalidated by a new quantum attack.

Thank you for the clarification.
I wasn't proposing something different, just trying to understand.

You are right that a the PQ attack would likely be used to recover private keys, not just forge signatures.

--
Michael Richardson <[e-mail]>   . o O ( IPv6 IøT consulting )
           Sandelman Software Works Inc, Ottawa and Worldwide