Re: [lamps] Call for Adoption of draft-ounsworth-pq-composite-sigs

["Kampanakis, Panos" <[e-mail]>]

I oppose adoption as well. 

Some of the reasons: 
- Combining sigs is not as urgent of an issue, so we better have trust to whatever we deploy before we need them.
- We can afford to wait for most signing use-cases, and those that can't, can use SLH-DSA which is conservatively secure. 
- Classical  and PQ sigs will coexist for a long time so any PQ signature security issue could be remediated by swapping back to classical. 


-----Original Message-----
From: Spasm <[e-mail]> On Behalf Of Stephen Farrell
Sent: Wednesday, April 17, 2024 9:21 AM
To: Russ Housley <[e-mail]>; LAMPS <[e-mail]>
Subject: RE: [EXTERNAL] [lamps] Call for Adoption of draft-ounsworth-pq-composite-sigs

CAUTION: This email originated from outside of the organization. Do not click links or open attachments unless you can confirm the sender and know the content is safe.



Hiya,

On 16/04/2024 19:29, Russ Housley wrote:
> At IETF 119, there was a short discussion of 
> draft-ounsworth-pq-composite-sigs.  The authors asked for a call for 
> adoption, and no one offered any reason not to move forward at that 
> time.
>
> This message starts a two-week call for adoption of this document.
> Please say whether you support adoption of this document by Tuesday,
> 30 April 2024.

(Perhaps unsurprisingly;-) I oppose adoption.

I don't think we have a sufficient understanding of the costs of adding composite sigs to x.509 based PKIs, and how those costs will be distributed amongst the various parties involved, nor about what's likely or unlikely to be deployed, to fire ahead now and define a pile of new composite sig algs. To do proper engineering, we should IMO have such an understanding before we start spraying out new OIDs each of which imposes costs on participants in PKIs.

Cheers,
S.

PS: I could also raise objections about lower level details of the draft but those could perhaps be handled after adoption, e.g. whether, and if so what kinds of, RSA sigs to include shouldn't be based on what's possible but on what's likely to get adopted esp. by real CAs, relying parties and key holders.