Re: [lamps] PQ-composite OR or K-of-N logic

[Michael Richardson <[e-mail]>]

I read through the list and the slides.  I couldn't be at the meeting on
Wednesday as I was travelling.

The document starts off with:
 "Even after the migration period, it may be advantageous for an entity's
  cryptographic identity to be composed of multiple public-key algorithms."

Panos and a few others have complained that the document attempts to have
signers tell verifiers what to do, and this should really a verifier policy.
Well, that would make a lot of sense for a CMS signature on your Mortgage,
or your MUA verifying my email.

But, signers REGULARLY tell verifiers what they've done and how to verify
things, and that's in the context of Certificates.  We have all these policy
OIDs, and CSPs, and Path Constraints, and ...  These are all signals from the
signer to the verifier.  The verifier can, of course, have a policy that says
that they ignore CSPs or Path Constraints, or...

I guess that the k-of-n part was in the slides only, as it's not in the
document that I could see.

I go back to the text I quoted above, and thinking about k-of-n.
I'm thinking that if there are more uses for the Composite-Or and
Composite-AND structures than *just* PQ transition, that the ROI on
implementing them may be much higher.  And thus the likelyhood that we'll
discovery and fix bugs relating to the new constructs is much higher.

I think that we can agree that the last thing we want is a widespread bug in
validation, at the point where we find it critical to transition.

ps: I giggled when I read ~~~ BEGIN EDNOTE 10~~~





--
Michael Richardson <[e-mail]>, Sandelman Software Works
 -= IPv6 IoT consulting =-