Re: [lamps] PQ-composite OR or K-of-N logic

["Kampanakis, Panos" <[e-mail]>]

Note my argument was not against an OR mechanism as a form of preventing flag days. My argument was that if the verifier does not have the mechanism built in already, then you will need some sort of a flag day or a negotiation. 

Fortunately, even in cases where you can't negotiate, we don't need a flag day because the logic is built in the verifiers already. Two examples 
1) CMS. RFC3852 was not clear about how to treat signatures from multiple signers for CMS and RFC4853 came to explain that when CMS carries many signatures you can verify one for one signer and then you can move on. 
2) UEFI / code signing. In UEFI, that happened with the transition of EFI signatures with SHA-1 digests to SHA-256 which was going to be a problem and require some sort of a flag day for old verifiers. The Windows Portable Executable (PE) format used to sign EFI binaries allows for multiple signatures. The signature is embedded in the PE file in a location specified by the Certificate Table entry. The signature stored in the location is in a bCertificate binary array which includes the PKCS#7 SignedData. Multiple signatures can be embedded by including multiple Certificate Table entries that point to different bCertificates. It is common for PE images to have dual/multiple signatures, a feature that is supported by many code signing vendors. Micosoft’s Authenticode code-signing technology and Tianocore, the UEFI open-source implementation, support verifying multiple PE signatures as well. So, when you are migrating you add both the old and the new signature and verifiers verify what they understand. 

Note, in these examples the verifier applies the logic it is supposed to apply (OR in these cases) which is what I am advocating for.  The signer or CA definitely does not define what the verifier is supposed to do. 


-----Original Message-----
From: Spasm <[e-mail]> On Behalf Of Blumenthal, Uri - 0553 - MITLL
Sent: Wednesday, April 27, 2022 9:57 AM
To: LAMPS <[e-mail]>
Subject: RE: [EXTERNAL][lamps] [EXTERNAL] Re: PQ-composite OR or K-of-N logic

CAUTION: This email originated from outside of the organization. Do not click links or open attachments unless you can confirm the sender and know the content is safe.



> > The only way to avoid a flag day is to negotiate
>
> Careful with this thinking; there are things in the world besides than 
> TLS and IKE; How does one negotiate with an S/MIME encryption cert 
> that you find in a directory, or a signed firmware binary that you're 
> trying to verify in a bootloader?

Absolutely!  100% agree with Mike here.