Re: [lamps] Proposed recharter text

[Roman Danyliw <[e-mail]>]

Hi!

> -----Original Message-----
> From: Benjamin Kaduk <[e-mail]>
> Sent: Wednesday, March 10, 2021 9:54 AM
> To: Salz, Rich <rsalz=[e-mail]>
> Cc: Roman Danyliw <[e-mail]>; LAMPS <[e-mail]>
> Subject: Re: [lamps] Proposed recharter text
> 
> On Wed, Mar 10, 2021 at 02:26:36PM +0000, Salz, Rich wrote:
> > I am concerned about having to decide the hybrid/multi-signature issue NOW
> during the rechartering.  It's way too soon.  I think we need to discuss the
> approaches in a technical context (i.e., as part of WG discussions).  What's the
> best way to do that other than put vague words into a charter?
> 
> I think we've seen (other) WG charters that include discussion of a topic to
> decide on an approach, with need to recharter to actually produce spec
> documents on that topic.  Just one option of many, of course...

+1.  We don't need to have approved charter language to discuss a topic.  We can even discuss and work on drafts that might shape the plan or approach.  We just can't adopt them without a charter change.  I noted in an earlier email [2], we may actually find that as we decompose this problem, not all of it is appropriate to tackle in LAMPS.  Given some of the expressed uncertainty, we may also need to charter "this scope" (whatever it might be) in iterative "chunks".  Certainly, this creates some administrative overhead, but this shouldn't be too high.

In rereading the discussion and trying to answer my own questions [1] on what a tighter scope would be, let me test it with some replacement text:

OLD 5(b)
The specifications developed will enable PKIX and S/MIME protocols to support hybrid key establishment and dual signature mechanisms

TIGHTER SCOPE:
5.b.1 = Specification(s) for identifiers, formats and operational practices to enable dual signature operations using algorithm(s) vetted by the NIST PQ effort

5.b.2 = Specification(s) for identifiers, formats and operational practices to enable hybrid key establishment using the algorithms vetted by the NIST PQ effort and hybrid key establishment constructions defined in a revised SP 800-56C

For me "operational practices" could potentially cover generation, validation, verification, etc.  As written, what it would exclude is updating PKI-related protocols and getting into any work that modifies other protocols that might leverage this work.

How confident are we that draft-ounsworth-pq-composite-sigs is the starting point we want (for just 5.b.1)?  Not pointing to this document specifically, but if we had one we could point to as a starting point this would also help create the bounding box on the new work and satisfy the other LAMPS constraint of "and there is at least one sufficiently well specified approach to the update so that the working group can sensibly evaluate whether to adopt a proposal"

Regards,
Roman

[1] https://mailarchive.ietf.org/arch/msg/spasm/rbcufPA13VfSRLBw41Sbb5bO-J0/
[2] https://mailarchive.ietf.org/arch/msg/spasm/jxmWz7MxaShMEopwE-ZJfzsIbYY/