Re: [lamps] Double signatures

[Ryan Sleevi <[e-mail]>]

On Mon, Sep 10, 2018 at 10:56 AM Erik Andersen <[e-mail]> wrote:

> Hi Folk,
>
>
>
> In ITU-T we have plans to allow for double signatures using the SIGNED
> parametrized data type defined in X.509 to cope with situation as described
> in the internet draft: “Multiple Public-Key Algorithm X.509 Certificates
> (draft-truskovsky-lamps-pq-hybrid-x509-01)”
>
>
>
> We suggest to enhance the SIGNED data type as shown below:
>
>
>
> *SIGNED{ToBeSigned} ::= SEQUENCE {*
>
> *  COMPONENTS OF SIGNATURE,*
>
> *  ...,*
>
> *  altAlgorithmIdentifier  AlgorithmIdentifier{{SupportedAlgorithms}}
> OPTIONAL,*
>
> *  altSignature            BIT STRING OPTIONAL  *
>
>   *} (WITH COMPONENTS {..., altAlgorithmIdentifier PRESENT, altSignature
> PRESENT } |*
>
> *     WITH COMPONENTS {..., altAlgorithmIdentifier ABSENT,  altSignature
> ABSENT } )*
>
>
>
> We are open to comments. We know that IETF is not a heavy user of this
> data type.
>
>
>
> We have no intention to use this extended data type for certificates and
> CRLs.
>
>
>
> For your information, SIGNATURE is defined as:
>
>
>
> *SIGNATURE ::= SEQUENCE {*
>
> *  algorithmIdentifier  AlgorithmIdentifier{{SupportedAlgorithms}},*
>
> *  signature            BIT STRING,*
>
> *  ... }*
>

>From the discussions in London (101), there were a number of challenges
identified during the discussion -
https://datatracker.ietf.org/meeting/101/materials/minutes-101-lamps-01.txt
- that fundamentally questioned that approach.

Has the ITU-T addressed or resolved those concerns? Are they not applicable
for some reason specific to ITU-T?

>