Re: [lamps] [EXTERNAL] Re: LAMPS Re-charter

Evidence records (RFC4998) and DSSC policies (RFC5698) got at that kind of thing using timestamps and Merkle trees with maintenance of the evidence record being required before an outgoing algorithm was of no value.

On 3/25/21, 1:12 PM, "Spasm on behalf of Mike Ounsworth" <spasm-bounces@ietf.org on behalf of Mike.Ounsworth=40entrust.com@dmarc.ietf.org> wrote:

    @dkg it sounds a bit like you're hinting at timestamping servers (or their modern equivalent: blockchains and merkle trees).

    I wonder if CT logs have the "time-bounded" property you're looking for: any certs indexed into the CT Merkle tree before the "quantum apocalypse" can still be trusted (the cert itself - DN, SANs, etc - can still be trusted; the keys inside it may well be compromised). Though the things getting CT-logged (public web certs) are only valid for ~ 1 year, so they'd likely be expired by the time you care to look back.

    ---
    Mike Ounsworth

    -----Original Message-----
    From: Spasm <spasm-bounces@ietf.org> On Behalf Of Michael Richardson
    Sent: March 25, 2021 9:50 AM
    To: Daniel Kahn Gillmor <dkg@fifthhorseman.net>
    Cc: LAMPS <spasm@ietf.org>; Russ Housley <housley@vigilsec.com>; Mike Ounsworth <Mike.Ounsworth=40entrust.com@dmarc.ietf.org>; Rene Struik <rstruik.ext@gmail.com>
    Subject: Re: [lamps] [EXTERNAL] Re: LAMPS Re-charter

    Daniel Kahn Gillmor <dkg@fifthhorseman.net> wrote:
        >> Daniel Kahn Gillmor <dkg@fifthhorseman.net> wrote:
        >> > PQ-hybrid signatures are a much easier thing to tackle than PQ-hybrid
        >> > encryption.  But PQ-hybrid encryption is also the thing that has the
        >> > most urgency.  Signature verification has an out: verifiers can
        >> > time-bound their acceptance of legacy signatures once a quantum-based
        >> > cryptanalytic attack becomes known to be plausible.
        >>
        >> Do you mean that a verifier can say, "I'll accept your legacy signature as
        >> long as it's less than 2hr old"
        >> ("2hr" being the time I think it takes for a PQ to be mounted).

        > The time-bound i was thinking of was:

        > - If a quantum-based cryptanalytic attack becomes feasible on a given
        > algorithm at time T, then a verifier can still re-validate any
        > signatures that arrived (that is, that the verifier has had a copy
        > of, or that is visible in some robust historic ledger) prior to time
        > T.  That is, old, pre-existing signatures are not automatically
        > invalidated by a new quantum attack.  Note that this is *not* the
        > case for encrypted material -- old, pre-existing encryption
        > protection can indeed be invalidated by a new quantum attack.

    Thank you for the clarification.
    I wasn't proposing something different, just trying to understand.

    You are right that a the PQ attack would likely be used to recover private keys, not just forge signatures.

    --
    Michael Richardson <mcr+IETF@sandelman.ca>   . o O ( IPv6 IøT consulting )
               Sandelman Software Works Inc, Ottawa and Worldwide

    _______________________________________________
    Spasm mailing list
    Spasm@ietf.org
    https://www.ietf.org/mailman/listinfo/spasm