Re: [lamps] [EXTERNAL] Re: PQ-hybrid or PQ-Composite?

[Mike Ounsworth <[e-mail]>]

Correct, downgrade / stripping _on the certificate_ will not work for the reason you state.

I'm thinking about the signature(s) on whatever document you're signing, for example an S/MIME email or PDF. A hybrid certificate is allowed to produce either 1 or 2 signatures. Imagine the signer produces 2 signatures but the verifier only receives 1, can it detect this? That depends on how the protocol (S/MIME, pdf, etc) handles Hybrid Certs.

The exact details of how to produce and verify Catalyst Hybrid certificates are in https://datatracker.ietf.org/doc/html/draft-truskovsky-lamps-pq-hybrid-x509-01 (ex.: the inner signature needs to be removed from the TBSCerficate after verifying the outer signature but before verifying the inner signature), and we're also standardized by ITU-T (I don't have the document link handy).

---
Mike Ounsworth
________________________________
From: tjtncks <[e-mail]>
Sent: Wednesday, October 26, 2022 7:54:44 PM
To: Mike Ounsworth <[e-mail]>; Kampanakis, Panos <[e-mail]>; 'LAMPS' <[e-mail]>
Subject: [EXTERNAL] Re: [lamps] PQ-hybrid or PQ-Composite?

WARNING: This email originated outside of Entrust.
DO NOT CLICK links or attachments unless you trust the sender and know the content is safe.
________________________________

about downgrade attack, wouldn't stripping pq extension breaks the outer signiture, as it is still a part of TBScertificate for classic alg?

not sure how hybrid signiture will verify, as by adding sig itself change the signiture of extensions asn object: so it have to signed something else: I don't get how it will work without effetively nest a full certificate inside of that extension

-------- 원본 이메일 --------
발신: Mike Ounsworth <Mike.Ounsworth=[e-mail]>
날짜: 22/10/27 04:03 (GMT+09:00)
받은 사람: "Kampanakis, Panos" <kpanos=[e-mail]>, 'LAMPS' <[e-mail]>
제목: Re: [lamps] PQ-hybrid or PQ-Composite?

Ah, you beat me to it!

Yes, ISARA has announced intent to dedicate the Hybrid Cert ("Catalyst") IP to the public domain.

The way I see it is this (off the top of my head, not a carefully researched answer):

Pros of Catalyst Hybrid:

* Extends X.509 in "the obvious way" via an extension.
* Fully backwards compatible because legacy clients will simply ignore the unrecognized non-critical extension.
* Avoids combinatorial explosion of pairwise OIDs.
* "Complexity" of checking both signatures lives at the X.509 layer.


Cons of Catalyst Hybrid (and Pros of composite):

* Hybrid Catalyst does not provide any encoding for transmitting multiple signatures, so you still need to either modify all the protocols to carry two signatures, or use a composite signature value.
* You carry the (very large) PQ key and sig over the network whether or not the client uses it (ie very hard to negotiate algs when a hybrid cert is in use).
* It is very difficult to audit what crypto was actually used at runtime since the server has no way to know whether the client actually checked the PQ part.
* Compare that with composite where you either negotiate a traditional OID or a composite OID and it's very clear what's being used.
* Catalyst Hybrid is not resistant to stripping / downgrade attack (ie Catalyst Hybrid certs only really make sense in an OR mode; though I suppose you could make them an AND mode by marking the extension CRITICAL).
* "Complexity" of checking both signatures lives at the crypto alg layer.



So as much as I'd like it to be as straight-forward of "We have Hybrid again, so let's drop Composite", I don't think it's that simple. I think there are strong advantages to each. I think I speak for Entrust that see value in supporting both Catalyst Hybrid and Composite certificates (as well as pure PQ / multi-cert), and would keep all three in our toolbox to recommend to customers depending on the details of their migration needs.

But I agree that they are very similar and this is a good discussion to have.

---
Mike Ounsworth

-----Original Message-----
From: Kampanakis, Panos <kpanos=[e-mail]>
Sent: October 26, 2022 1:24 PM
To: Mike Ounsworth <[e-mail]>; 'LAMPS' <[e-mail]>
Subject: [EXTERNAL] PQ-hybrid or PQ-Composite?

WARNING: This email originated outside of Entrust.
DO NOT CLICK links or attachments unless you trust the sender and know the content is safe.

______________________________________________________________________
Hi Mike, composite drafts authors, and WG,

Sorry for the monkey wrench. I am sure you are aware of this https://urldefense.com/v3/__https://www.isara.com/company/newsroom/isara-dedicates-four-hybrid-certificate-patents-to-the-public.html__;!!FJ-Y8qCqXTj2!aztm9JK1STn0XcErfeMf5yXQFR_5MMDuqP3WVKhZK9uu1C041s2dbh6qgNpa4nZj588VU3vhLFDl6BrRRvVIpDYvnCIBq3gm_SO6$ . ISARA seems to have opened up the patents they had on hybrid certs. Hybrid certs do the same thing as composites, but they add the additional algorithm in an optional extension, not concatenated. One advantage of hybrids is that we don't need a bunch PQ-composite OIDs. One disadvantage could be that the PQ-verifier needs to be careful to verify and not ignore the extension.

If the IPR is indeed open for use now, should the WG be discussing which is the better option?

Rgs,
Panos

Any email and files/attachments transmitted with it are confidential and are intended solely for the use of the individual or entity to whom they are addressed. If this message has been sent to you in error, you must not copy, distribute or disclose of the information it contains. Please notify Entrust immediately and delete the message from your system.
_______________________________________________
Spasm mailing list
[e-mail]
https://www.ietf.org/mailman/listinfo/spasm<https://urldefense.com/v3/__https://www.ietf.org/mailman/listinfo/spasm__;!!FJ-Y8qCqXTj2!djoOC1HF8WuuXZ1K4QU_V8A4UZdS2mZ7rBiyXeakQ09_IIpXMkKwA6AZSG6YQsAWFK0NRV-DLaBt_S6m0ZxD$>