Re: [lamps] Call for Adoption of draft-ounsworth-pq-composite-sigs

[Russ Housley <[e-mail]>]

> On Apr 17, 2024, at 10:25 AM, Hubert Kario <[e-mail]> wrote:
> 
> On Wednesday, 17 April 2024 15:59:50 CEST, Kampanakis, Panos wrote:
>> I oppose adoption as well. 
>> Some of the reasons: - Combining sigs is not as urgent of an issue, so we better have trust to whatever we deploy before we need them.
>> - We can afford to wait for most signing use-cases, and those that can't, can use SLH-DSA which is conservatively secure. - Classical  and PQ sigs will coexist for a long time so any PQ signature security issue could be remediated by swapping back to classical. 
> 
> To add to that, signatures that need to remain secure for a long
> period of time (legal documents and such) can already use multiple
> time-stamps to prove using both classical and post-quantum crypto
> that the original classical signature was created before
> cryptographically relevant quantum computers were created.

In a side discussion, I learned that some people involved in this thread are unaware of the Evidence Record Syntax (ERS) specified in RFC 4998.

Abstract

   In many scenarios, users must be able prove the existence and
   integrity of data, including digitally signed data, in a common and
   reproducible way over a long and possibly undetermined period of
   time.  This document specifies the syntax and processing of an
   Evidence Record, a structure designed to support long-term non-
   repudiation of existence of data.

Russ