Re: [lamps] [EXTERNAL] Re: draft-ounsworth-pq-composite-sigs-11

[Mike Ounsworth <[e-mail]>]

Hi Stephen,

> Other agencies have recommended against hybrid KEMs by times, and we happily ignore that.

I fully disagree. We are not ignoring that at all.
LAMPS has draft-ietf-lamps-kyber which instructs how to use Kyber by itself in CMS, which fulfills the requirements from people who do not want hybrids. And similarly draft-ietf-lamps-dilithium-certificates for pure Dilithium signatures.
My understanding is that the IETF does not play politics; if multiple governments have conflicting technical requirements, then we should produce separate mechanism to satisfy each. It is clear to me that there exists a need for this motivated by BSI and ANSSI recommendations. Full stop.


I have written some text into the composite signatures draft that I think addresses this. It is currently on a github pull request:

https://github.com/EntrustCorporation/draft-ounsworth-composite-sigs/pull/131

It adds the following text to the Introduction:

+ In particular, certain jurisdictions are recommending or requiring that PQC lattice schemes only be used within in a PQ/T hybrid. As an example, we point to [BSI2021] which includes the following recommendation:

+ "Therefore, quantum computer-resistant methods should
+ not be used alone - at least in a transitional period - but
+ only in hybrid mode, i.e. in combination with a classical
+ method. For this purpose, protocols must be modified
+ or supplemented accordingly. In addition, public key
+ infrastructures, for example, must also be adapted"

+ In addition, [BSI2021] specifically references this specification as a concrete example of hybrid X.509 certificates.

+ A more recent example is [ANSSI2024], a document co-authored by French Cybersecurity Agency (ANSSI), 
+ Federal Office for Information Security (BSI), Netherlands National Communications Security Agency (NLNCSA), and
+ Swedish National Communications Security Authority, Swedish Armed Forces which makes the following statement:

+ “In light of the urgent need to stop relying only on quantum-vulnerable public-key cryptography for key establishment, the clear priority should therefore be the migration to post-quantum cryptography in hybrid solutions”

+ This specification represents the straightforward implementation of the hybrid solutions called for by European cyber security agencies.


To flip the burden of proof back onto the detractors: if you think that this work should not proceed, then please justify why the IETF does not need to produce a mechanism to fulfil this recommendation from multiple governments. Or perhaps the IETF already has a mechanism that satisfies this requirement, but if so, I am not aware of one -- for example all of the Multi-Cert mechanisms that I am aware of operate in an OR mode, and are therefore not "hybrids" as defined in the above-referenced BSI recommendations document.

---
Mike Ounsworth

-----Original Message-----
From: Stephen Farrell <[e-mail]> 
Sent: Thursday, February 8, 2024 12:00 PM
To: Mike Ounsworth <[e-mail]>; Kris Kwiatkowski <[e-mail]>; [e-mail]
Subject: Re: [EXTERNAL] Re: [lamps] draft-ounsworth-pq-composite-sigs-11


Hiya,

On 08/02/2024 15:31, Mike Ounsworth wrote:
> Not to be flippant, but I think the answer is "everywhere".

You may be unsurprised to hear that I disagree.

> The current recommendations (at least from some European governments) 
> are to not use lattice schemes in isolation, but only in hybrids. So 
> anywhere that uses long-term keys (ex.: certs for CAs, S/MIME, Code 
> Signing, Document Signing, any-other-thing Signing, etc) and wants to 
> migrate to Dilithium *should* migrate to a dilithium+ecc or
> dilithium+rsa composite.
> 
> Would it address your comment if we add text to the Intro to that 
> effect that references the various government calls for hybrids?

Not for me, no. Other agencies have recommended against hybrid KEMs by times, and we happily ignore that. We should also be doing the engineering work to determine what's needed where and when. So I think we need a demonstration that these kinds of hybrid signing algs are needed, and needed now. I've not seen that myself, especially in a context where pq signing algs seem to be evolving a lot.

S.

> 
> --- Mike Ounsworth
> 
> -----Original Message----- From: Spasm <[e-mail]> On 
> Behalf Of Stephen Farrell Sent: Wednesday, February 7, 2024 4:25 PM
> To: Kris Kwiatkowski <[e-mail]>; [e-mail] Subject:
> [EXTERNAL] Re: [lamps] draft-ounsworth-pq-composite-sigs-11
> 
> 
> Hiya,
> 
> On 07/02/2024 22:07, Kris Kwiatkowski wrote:
>> * Is there a document describing real-world use cases for this draft? 
>> I’m aware of draft-vaira-pquip-pqc-use-cases, but really I’m looking 
>> for use cases where draft-ounsworth-pq-composite-sigs will be clearly 
>> very useful/necessary to have.
> 
> I'd also be v. interested in that, and didn't find such text when I 
> looked a few months back. (And I think such text is very much
> needed.)
> 
> Cheers, S.