Re: [lamps] [EXTERNAL] Re: LAMPS Re-charter

[Daniel Kahn Gillmor <[e-mail]>]

On Tue 2021-03-23 05:24:32 +0000, Mike Ounsworth wrote:

> My current understanding is that strong cryptography wants hybrid and
> dual modes to be a “MUST USE ALL” sort of thing, while strong
> backwards compatibility wants a “client can use as many as they
> support” kind of thing. Conflicting requirements.
>
> For signatures you can design such a system where the signer produces
> all the signatures and the verifying only checks as many as they can
> since dual signatures are parallel and independent anyway (In an
> upcoming version of draft-ounsworth-pq-composite-sigs I have added a
> separate OID for "Composite-OR" to keep the wishy-washy dual
> signatures distinct from the strict ones, and I'm expecting a healthy
> debate to arise about whether this is a good idea or not).
>
> But for keyEncipherment and dataEncipherment I don't think you can do
> that at all;

I agree with Mike's characterizations here about the problem space.

PQ-hybrid signatures are a much easier thing to tackle than PQ-hybrid
encryption.  But PQ-hybrid encryption is also the thing that has the
most urgency.  Signature verification has an out: verifiers can
time-bound their acceptance of legacy signatures once a quantum-based
cryptanalytic attack becomes known to be plausible.  Encryption has no
such out -- an attack isn't necessarily visible to either the producer
or consumer of the ciphertext.  And, an encrypted object might be
attacked in the future so it needs to defend against future mechanisms.

So if we're going to prioritize this work in LAMPS, I think we need to
prioritize the hard problem.  That means tackling PQ-hybrid public key
keyAgreement or keyEncipherment or dataEncipherment schemes that are
"MUST USE ALL", along with whatever attendent signalling mechanisms are
necessary for experimentation and (hopefully) deployment.

I generally advocate for tackling the easier problems first, but i don't
think we should block handling the encryption side of things while we
wrestle with the signatures.

          --dkg