Re: [lamps] PQ-composite OR or K-of-N logic

"Kampanakis, Panos" <kpanos@amazon.com> Sun, 24 April 2022 01:48 UTC

Thread-Topic: [lamps] Re: PQ-composite OR or K-of-N logic
From: "Kampanakis, Panos" <kpanos@amazon.com>
To: Michael Richardson <mcr+ietf@sandelman.ca>, LAMPS <spasm@ietf.org>
Thread-Index: AQHYVzSc6Z1FPQA7gUmVWY35xrznTKz+SxOw
Date: Sun, 24 Apr 2022 01:48:02 +0000
Message-ID: <423419504256427b83c889f9b5c607b7@EX13D01ANC003.ant.amazon.com>
References: <f2fb2b2459fe42818348838eb14cc2ac@EX13D01ANC003.ant.amazon.com> <29E39FB1-D8E5-40E9-AFC0-5A8EBBB705DF@vigilsec.com> <DM6PR11MB38025338B4FA3AED0AA99E3196F79@DM6PR11MB3802.namprd11.prod.outlook.com> <1312783.1650733573@dooku>
In-Reply-To: <1312783.1650733573@dooku>
Accept-Language: en-US
Content-Language: en-US
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
Archived-At: <https://mailarchive.ietf.org/arch/msg/spasm/YQYrZZkoJ4h2madVaXePmDWsBns>
Subject: Re: [lamps] PQ-composite OR or K-of-N logic
Precedence: list

Hi Michael, 

Both OR or AND are not backwards compatible. The new OID (regardless of OR or AND logic) will not be understood by verifiers that have not been upgraded. Not to mention that verifiers that don't understand composite will not want to see the extra data which could slow down their communications. 

The only way to avoid a flag day is to negotiate; if the verifier understands the composite signature give it to it, otherwise just give the classical. 

-----Original Message-----
From: Spasm <spasm-bounces@ietf.org> On Behalf Of Michael Richardson
Sent: Saturday, April 23, 2022 1:06 PM
To: LAMPS <spasm@ietf.org>
Subject: RE: [EXTERNAL][lamps] [EXTERNAL] Re: PQ-composite OR or K-of-N logic

CAUTION: This email originated from outside of the organization. Do not click links or open attachments unless you can confirm the sender and know the content is safe.

Serge Mister <Serge.Mister=40entrust.com@dmarc.ietf.org> wrote:
    > As I mentioned on the call, I'm not fully convinced that deciding which
    > signatures a relying party must verify is entirely a decision for the
    > relying party.  When an entity obtains a certificate from a CA,
    > signatures verifiable with the certificate are attributed to the entity
    > named in the certificate.  The certificate holder then wouldn't want a
    > weak key bound to their identity.  If a composite key can be used in
    > "OR" mode, the key is weakened when any of the algorithms is weakened.

Yeah, but we need this OR mode to operationally be able to deploy.

Yes, it true it could be subject to a bid-down attack against the weaker algorithm.  But, this is where the verify policy does matter.  Bid-down attacks only work when both parties have open policies.
Until there is there is a clear attack, there isn't a weak algorithm.
But, when an attack becomes known, verifies have to change their policies.

Without the OR mechanism, we wind up with a flag day where all signers and all verifiers have to upgrade within a renewal/CRL-signing epoch.  That's just not practical.

--
Michael Richardson <mcr+IETF@sandelman.ca>, Sandelman Software Works  -= IPv6 IoT consulting =-

[lamps] PQ-composite OR or K-of-N logic Kampanakis, Panos
Re: [lamps] PQ-composite OR or K-of-N logic Russ Housley
Re: [lamps] [EXTERNAL] Re: PQ-composite OR or K-o… Russ Housley
Re: [lamps] [EXTERNAL] Re: PQ-composite OR or K-o… Serge Mister
Re: [lamps] PQ-composite OR or K-of-N logic Kampanakis, Panos
Re: [lamps] PQ-composite OR or K-of-N logic Serge Mister
Re: [lamps] PQ-composite OR or K-of-N logic Michael Richardson
Re: [lamps] [EXTERNAL] Re: PQ-composite OR or K-o… Michael Richardson
Re: [lamps] PQ-composite OR or K-of-N logic Kampanakis, Panos
Re: [lamps] PQ-composite OR or K-of-N logic Kampanakis, Panos
Re: [lamps] [EXTERNAL] Re: PQ-composite OR or K-o… Klaußner, Jan
Re: [lamps] PQ-composite OR or K-of-N logic Klaußner, Jan
Re: [lamps] PQ-composite OR or K-of-N logic Russ Housley
Re: [lamps] [EXTERNAL] Re: PQ-composite OR or K-o… Mike Ounsworth
Re: [lamps] [EXTERNAL] Re: PQ-composite OR or K-o… Blumenthal, Uri - 0553 - MITLL
Re: [lamps] [EXTERNAL] Re: PQ-composite OR or K-o… Santosh Chokhani
Re: [lamps] PQ-composite OR or K-of-N logic Kampanakis, Panos
Re: [lamps] PQ-composite OR or K-of-N logic Kampanakis, Panos
Re: [lamps] PQ-composite OR or K-of-N logic Carl Wallace
Re: [lamps] PQ-composite OR or K-of-N logic Michael Richardson
Re: [lamps] PQ-composite OR or K-of-N logic Michael Richardson
Re: [lamps] [EXTERNAL] Re: PQ-composite OR or K-o… Mike Ounsworth
Re: [lamps] [EXTERNAL] Re: PQ-composite OR or K-o… Santosh Chokhani
Re: [lamps] PQ-composite OR or K-of-N logic Klaußner, Jan
Re: [lamps] PQ-composite OR or K-of-N logic Michael Jenkins
Re: [lamps] PQ-composite OR or K-of-N logic Klaußner, Jan
Re: [lamps] PQ-composite OR or K-of-N logic Tadahiko Ito
Re: [lamps] PQ-composite OR or K-of-N logic Kampanakis, Panos
Re: [lamps] PQ-composite OR or K-of-N logic Russ Housley