Re: [lamps] Hybrid pkix isn't needed

Hi

> Authentication breaks are not retroactive:
Could you clarify if signing purposes ( code-signing, and OCSP signing,
time-stamping, etc.) is outside the scope of your comment or not.
I am not sure if we need bonded certs or hybrid cert for those use-cases,
but it might be better to have some mechanisms for those use-cases.

Regards Tadahiko


2023年1月30日(月) 8:43 Watson Ladd <watsonbladd@gmail.com>:

> Dear all,
>
> I don't think linking certs or special provisions for hybrid
> encryption or authentication are a good idea.  A hybrid encryption
> scheme should be an encryption scheme with a public and private key,
> just like any other key you can put in the PKIX.
>
> If for backwards compatibility you want to have multiple kinds of keys
> just like we do with RSA and ECDSA keys in TLS, just do that! Don't
> add complexities to try to link them or force people to find both keys
> at once for an operation. We know that the transition model with
> multiple unrelated certs works, and we have experience and fixed bugs
> that resulted. Let's use that instead of have new bugs to fix.
>
> The other thing is hybrid auth is worthless. Authentication breaks are
> not retroactive: a break of an algorithm at a time in the future
> doesn't threaten the security properties of authentication in the
> past. That's different from encryption, where you do potentially want
> to ensure a new post-quantum algorithm is no worse than a classical
> one, but the case for it is fairly weak.
>
> Sincerely,
> Watson Ladd
>
> _______________________________________________
> Spasm mailing list
> Spasm@ietf.org
> https://www.ietf.org/mailman/listinfo/spasm
>