Re: [lamps] Hybrid pkix isn't needed

[Ilari Liusvaara <[e-mail]>]

On Mon, Jan 30, 2023 at 10:49:32AM -0800, Watson Ladd wrote:
> On Mon, Jan 30, 2023 at 10:30 AM Mike Ounsworth
> <[e-mail]> wrote:
> <snip>
> 
> > For TLS or IKEv2, yes, signatures are less urgent than encryption,
> > but in general you know that you’re fighting a losing battle here,
> > right? Especially since the NSA in their CNSA 2.0 have marked
> > code-signing as the most urgent use case to migrate to PQC. 
> 
> In that case what's the point of hybridization: you need very high
> security due to lack of updates, you're not signing very much, so XMSS
> or another hashed based scheme is the obvious choice. 

CNSA 2.0 specifies LMS or XMSS. And from what I can tell, this part
is already active, so it is deployable right now (unlike say the
asymmetric encrpytion parts).


> > Another example is PDF signing; if I can factor the signer’s
> > private key so I can modify and re-sign the PDF then what’s
> > stopping me from also back-dating the timestamps?

This is only possible after total breakdown of signature algorithm.
And bad enough classical break would do it too.


> > Yet another is S/MIME email certificates: you need PQ CAs before
> > you can issue PQ encryption certs.

Wrong. Trying the two together is a major security issue. The time-
scales are just very different:

- Not a problem: Attacker breaking the CA keys three years from now
  (when the S/MIME certificate has expired).

- *CATASTROPHIC* (as in impossible to recover from) problem: Attacker
  breaking the encryption key 20 years from now when the information
  is still sensitive.


> Why? There's nothing wrong with mixed algorithms in a chain. The
> bigger issue here is root program policies about what can be signed.

Yeah, for example CABForum S/MIME baseline requirements only allow RSA
and ECIES for encryption.

That would be a major problem once Kyber is standard.



-Ilari