Re: [lamps] PQ-composite OR or K-of-N logic

[Tadahiko Ito <[e-mail]>]

Hi Jan

> In reality that's mostly the case when something is very valuable or
important
> so you want an additional neutral witness and safe repository.

I believe, some companies or CAs extend protection period of data longer
than their certificates validity period with notary services.
At least our company does, and In our case, It is because of the
Certificate for document signing or timestamping has shorter validity
period compare with required lifetime of data

Your known environment prohibit extension of protection period by using
other mechanism (e.g. notary service), even that service is run by same
company as issuing authority?
If it were not case, notary service might be worth to consider.

> But as it comes not for free, I do not see how this could help for e.g.
signatures you give in your normal life,
> e.g. to sign contracts, tax declaration etc.

your suggestion sound like, try to implement single certificates, which can
be secure for long period.
In the reality, building mechanism which is secure for 50years should be
very costly,
much more than building 5 mechanisms secure for 10 years (I am ignoring
switching period, but it does not change conclusion).
It means,  even if CA provide notary service by themselves, notary approach
can be cost effective than providing very long validity period certificates
(It may be related to how strictly mechanism deal with uncertainty etc.).

your claim might be true for some environment, but It does not sound quite
general environment for me.

Regards Tadahiko

2022年5月4日(水) 20:18 Klaußner, Jan <[e-mail]>:

> Russ:
>
> Yes, a notary can be used. In reality that's mostly the case when
> something is very valuable or important so you want an additional neutral
> witness and safe repository. But as it comes not for free, I do not see how
> this could help for e.g. signatures you give in your normal life, e.g. to
> sign contracts, tax declaration etc. They also are legally valid for
> lifetime, so I think we need to have other mechanism to solve algorithm
> obsolescence.
>
> > -----Ursprüngliche Nachricht-----
> > Von: Russ Housley <[e-mail]>
> > Gesendet: Mittwoch, 27. April 2022 15:44
> > An: Klaußner, Jan <[e-mail]>
> > Cc: LAMPS <[e-mail]>
> > Betreff: Re: [lamps] PQ-composite OR or K-of-N logic
> >
> > Jan:
> >
> > A notary is often used when a signature needs to be verifiable for many
> > decades. RFC 4998 specifies the Evidence Record Syntax (ERS), which can
> be
> > used to apply additional signatures by a notary.
> >
> > Russ
> >
> > > On Apr 27, 2022, at 4:36 AM, Klaußner, Jan <[e-mail]>
> > wrote:
> > >
> > > Hi all,
> > >
> > > First I completely agree with Michaels view on verification policies.
> > > Especially in open PKIs that are not under control of one company
> > > there is a need to signal how verification should be done.
> > >
> > > On the question about use cases beside the PQ transition: We believe
> > > there is a high probability that new algorithms are successfully
> > > attacked during the next decades.
> > >
> > > Therefore we want establish some agility in an PKI to more easily
> > > switch algorithms without an immediate PKI rollover. In our case we
> > > are also talking about use cases for document signing or long term
> > > encryption, where digital signatures need to be valid for longer
> > > periods, sometimes up to 50 years.
> > >
> > > So in case one algorithm is broken, the documents still remain
> secure/valid.
> > > There would be an immediate need to reconfigure or update
> > > verifier/signing software not to use this algorithm anymore, but there
> > > is some more time to replace the algorithm in the PKI.
> > > Once again, this is even more important in an open PKI.
> > >
> > > The k-of-n mode here is providing this agility and also the increased
> > > security of the AND mode, simply put.
> > >
> > > I hope our point is now more clear to the group
> > >
> > > Br
> > > Jan
> > >> -----Ursprüngliche Nachricht-----
> > >> Von: Spasm <[e-mail]> Im Auftrag von Michael
> > Richardson
> > >> Gesendet: Samstag, 23. April 2022 19:02
> > >> An: LAMPS <[e-mail]>
> > >> Betreff: Re: [lamps] PQ-composite OR or K-of-N logic
> > >>
> > >>
> > >> I read through the list and the slides.  I couldn't be at the meeting
> > >> on Wednesday as I was travelling.
> > >>
> > >> The document starts off with:
> > >> "Even after the migration period, it may be advantageous for an
> > >> entity's  cryptographic identity to be composed of multiple
> > >> public-key
> > > algorithms."
> > >>
> > >> Panos and a few others have complained that the document attempts to
> > >> have signers tell verifiers what to do, and this should really a
> > >> verifier
> > > policy.
> > >> Well, that would make a lot of sense for a CMS signature on your
> > >> Mortgage, or your MUA verifying my email.
> > >>
> > >> But, signers REGULARLY tell verifiers what they've done and how to
> > >> verify things, and that's in the context of Certificates.  We have
> > >> all these
> > > policy
> > >> OIDs, and CSPs, and Path Constraints, and ...  These are all signals
> > >> from
> > > the
> > >> signer to the verifier.  The verifier can, of course, have a policy
> > >> that
> > > says that
> > >> they ignore CSPs or Path Constraints, or...
> > >>
> > >> I guess that the k-of-n part was in the slides only, as it's not in
> > >> the
> > > document
> > >> that I could see.
> > >>
> > >> I go back to the text I quoted above, and thinking about k-of-n.
> > >> I'm thinking that if there are more uses for the Composite-Or and
> > >> Composite-AND structures than *just* PQ transition, that the ROI on
> > >> implementing them may be much higher.  And thus the likelyhood that
> > >> we'll discovery and fix bugs relating to the new constructs is much
> higher.
> > >>
> > >> I think that we can agree that the last thing we want is a widespread
> > >> bug
> > > in
> > >> validation, at the point where we find it critical to transition.
> > >>
> > >> ps: I giggled when I read ~~~ BEGIN EDNOTE 10~~~
> > >>
> > >>
> > >>
> > >>
> > >>
> > >> --
> > >> Michael Richardson <[e-mail]>, Sandelman Software
> > Works
> > >> -= IPv6 IoT consulting =-
> > >>
> > >>
> > >
> > > _______________________________________________
> > > Spasm mailing list
> > > [e-mail]
> > > https://www.ietf.org/mailman/listinfo/spasm
>
> _______________________________________________
> Spasm mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/spasm
>