Re: [lamps] [EXTERNAL] Re: Hybrid pkix isn't needed

Hi Ilari,

Just for my curiosity, are you saying that people are today issuing Kyber S/MIME certs from RSA or ECDSA CAs? Can you point to an example because I wasn't aware that was being done.

---
Mike Ounsworth

-----Original Message-----
From: Spasm <spasm-bounces@ietf.org> On Behalf Of Ilari Liusvaara
Sent: Tuesday, January 31, 2023 3:59 AM
To: spasm@ietf.org
Subject: [EXTERNAL] Re: [lamps] Hybrid pkix isn't needed

WARNING: This email originated outside of Entrust.
DO NOT CLICK links or attachments unless you trust the sender and know the content is safe.

______________________________________________________________________
On Mon, Jan 30, 2023 at 10:49:32AM -0800, Watson Ladd wrote:
> On Mon, Jan 30, 2023 at 10:30 AM Mike Ounsworth
> <Mike.Ounsworth@entrust.com> wrote:
> <snip>
>
> > For TLS or IKEv2, yes, signatures are less urgent than encryption,
> > but in general you know that you’re fighting a losing battle here,
> > right? Especially since the NSA in their CNSA 2.0 have marked
> > code-signing as the most urgent use case to migrate to PQC.
>
> In that case what's the point of hybridization: you need very high
> security due to lack of updates, you're not signing very much, so XMSS
> or another hashed based scheme is the obvious choice.

CNSA 2.0 specifies LMS or XMSS. And from what I can tell, this part is already active, so it is deployable right now (unlike say the asymmetric encrpytion parts).

> > Another example is PDF signing; if I can factor the signer’s private
> > key so I can modify and re-sign the PDF then what’s stopping me from
> > also back-dating the timestamps?

This is only possible after total breakdown of signature algorithm.
And bad enough classical break would do it too.

> > Yet another is S/MIME email certificates: you need PQ CAs before you
> > can issue PQ encryption certs.

Wrong. Trying the two together is a major security issue. The time- scales are just very different:

- Not a problem: Attacker breaking the CA keys three years from now
  (when the S/MIME certificate has expired).

- *CATASTROPHIC* (as in impossible to recover from) problem: Attacker
  breaking the encryption key 20 years from now when the information
  is still sensitive.

> Why? There's nothing wrong with mixed algorithms in a chain. The
> bigger issue here is root program policies about what can be signed.

Yeah, for example CABForum S/MIME baseline requirements only allow RSA and ECIES for encryption.

That would be a major problem once Kyber is standard.

-Ilari

_______________________________________________
Spasm mailing list
Spasm@ietf.org
https://urldefense.com/v3/__https://www.ietf.org/mailman/listinfo/spasm__;!!FJ-Y8qCqXTj2!dJ682EDi7IPgc3CJvo8yk7XK2igYVLCVBXZJGcPO-_0wIFN6j52TT2DYrVdgrmQrNk6YOe04OoIeDoofA8SGGXgBQKFEIPRNJzM$
Any email and files/attachments transmitted with it are confidential and are intended solely for the use of the individual or entity to whom they are addressed. If this message has been sent to you in error, you must not copy, distribute or disclose of the information it contains. Please notify Entrust immediately and delete the message from your system.