Re: [lamps] New drafts available - non-composite hybrid authentication, and binding certs

["[e-mail]" <[e-mail]>]

Thanks for the comments!
Yes, we see a main advantage to this approach being one migration as you described. There is definitely more work put onto the protocol using a non-composite approach, but it may be preferable to introducing changes at the PKI or cryptographic library level. We are definitely in agreement with you, the discussion will hinge on what is best appropriate for the use case.

-Alie
________________________________
From: Spasm <[e-mail]> on behalf of Kampanakis, Panos <kpanos=[e-mail]>
Sent: Wednesday, March 23, 2022 12:42 PM
To: [e-mail] <aebecke=[e-mail]>rg>; [e-mail] <[e-mail]>
Subject: Re: [lamps] New drafts available - non-composite hybrid authentication, and binding certs


Thx for the drafts Alie.



Regarding draft-becker-guthrie-noncomposite-hybrid-auth<https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fdatatracker.ietf.org%2Fdoc%2Fdraft-becker-guthrie-noncomposite-hybrid-auth%2F&data=04%7C01%7Caebecke%40uwe.nsa.gov%7C3e9d6a7bd4d84d5e3ce608da0cec54ec%7Cd61e9a6ffc164f848a3e6eeff33e136b%7C0%7C0%7C637836506444366967%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000&sdata=quBEWVmwzBE3gJ%2FjW6beqphCDqpGCkgfp%2FUmtmSoVUs%3D&reserved=0> , I guess the advantage of the approach seems to be that if you don’t trust the PQ signature yet, you won’t have to migrate twice, once with a composite algorithm cert and later with a pure PQ one.



I have to point out some disadvantages though compared to the PQ-composite option

- there is redundancy in the cert data sent over the wire in the PQ-hybrid case.

- the onus is pushed to the transport protocol which now has to do much more than support a new OID. Introducing two OIDs and two PKIs is the PQ-composite option. Not sure how to quantify which is more work.

- there is more complexity in tying the two identities together by using the new extension.



Imo the discussion becomes what do we consider easier and better to deploy and use, PQ-composite or PQ-noncomposite-hybrid.



Rgs,

Panos







From: Spasm <[e-mail]> On Behalf Of [e-mail]
Sent: Tuesday, March 22, 2022 2:17 PM
To: [e-mail]
Subject: [EXTERNAL] [lamps] New drafts available - non-composite hybrid authentication, and binding certs



CAUTION: This email originated from outside of the organization. Do not click links or open attachments unless you can confirm the sender and know the content is safe.



Hi LAMPS,



  Two new drafts related to PQ migration are available here (note- these drafts are an update to the talk we gave at IETF112 in November) : https://datatracker.ietf.org/doc/draft-becker-guthrie-cert-binding-for-multi-auth/<https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fdatatracker.ietf.org%2Fdoc%2Fdraft-becker-guthrie-cert-binding-for-multi-auth%2F&data=04%7C01%7Caebecke%40uwe.nsa.gov%7C3e9d6a7bd4d84d5e3ce608da0cec54ec%7Cd61e9a6ffc164f848a3e6eeff33e136b%7C0%7C0%7C637836506444366967%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000&sdata=uRePcx1q%2BAAbC%2BNuCUyAxUod6P1KJQ9lTjrAvAEHi%2Bw%3D&reserved=0> and https://datatracker.ietf.org/doc/draft-becker-guthrie-noncomposite-hybrid-auth/<https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fdatatracker.ietf.org%2Fdoc%2Fdraft-becker-guthrie-noncomposite-hybrid-auth%2F&data=04%7C01%7Caebecke%40uwe.nsa.gov%7C3e9d6a7bd4d84d5e3ce608da0cec54ec%7Cd61e9a6ffc164f848a3e6eeff33e136b%7C0%7C0%7C637836506444366967%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000&sdata=quBEWVmwzBE3gJ%2FjW6beqphCDqpGCkgfp%2FUmtmSoVUs%3D&reserved=0>





The noncomposite-hybrid-auth-00 draft is an informational draft that gives a general overview of hybrid authentication, and details the solution space of what we are calling non-composite type hybrid solutions for authentication.



The cert-binding-for-multi-auth-00 draft defines a new CSR attribute, bindingRequest, and a new X.509 certificate extension, BoundCertificates, which together provide additional assurance that multiple certificates (used in non-composite hybrid authentication) each belong to the same end entity.



  Please feel free to provide any comments and feedback!



  Regards,

  Alie Becker + coauthors Rebecca Guthrie, Mike Jenkins



  ----

  Alison Becker, PhD

  Center for Cybersecurity Standards

  National Security Agency

T