Re: [lamps] [EXTERNAL] Re: draft-ounsworth-pq-composite-sigs-11

[Mike Ounsworth <[e-mail]>]

> I'm not currently being a detractor. I'm asking for someone to document a case where these hybrid signing algorithms are needed and needed now. If that's not doable then I find that fairly telling.

The BSI has documented it. Here is their document:
https://www.bsi.bund.de/SharedDocs/Downloads/EN/BSI/Publications/Brochure/quantum-safe-cryptography.pdf

The French Cybersecurity Agency (ANSSI), Federal Office for Information Security (BSI), Netherlands National Communications Security Agency (NLNCSA), and
Swedish National Communications Security Authority, Swedish Armed Forces have documented it. Here is their document:
https://cyber.gouv.fr/sites/default/files/document/Quantum_Key_Distribution_Position_Paper.pdf

I am unclear why you don't accept this as proof-of-need.


I am also unclear why proof-of-need is a requirement for RFC publication. Are you trying to tell me that the IETF has never once published an RFC that didn't end up getting used in production? There is a government recommendation document specifically citing this I-D as an example of "good". Surely that is enough by itself to meet the IETF's bar for usefulness.

I have seen NSA documents (I'm thinking of draft-ietf-lamps-cert-binding-for-multi-auth) be adopted with a justification that boils down to "DoD wants this for internal use". That is less justification than we have for composite sigs, yet somehow that was acceptable, and this is not?

---
Mike Ounsworth

-----Original Message-----
From: Stephen Farrell <[e-mail]> 
Sent: Thursday, February 8, 2024 12:32 PM
To: Mike Ounsworth <[e-mail]>; Kris Kwiatkowski <[e-mail]>; [e-mail]
Subject: Re: [EXTERNAL] Re: [lamps] draft-ounsworth-pq-composite-sigs-11


Hiya,

On 08/02/2024 18:26, Mike Ounsworth wrote:
> Hi Stephen,
> 
>> Other agencies have recommended against hybrid KEMs by times, and we happily ignore that.
> 
> I fully disagree. We are not ignoring that at all.
> LAMPS has draft-ietf-lamps-kyber which instructs how to use Kyber by itself in CMS, which fulfills the requirements from people who do not want hybrids. And similarly draft-ietf-lamps-dilithium-certificates for pure Dilithium signatures.
> My understanding is that the IETF does not play politics; if multiple governments have conflicting technical requirements, then we should produce separate mechanism to satisfy each. It is clear to me that there exists a need for this motivated by BSI and ANSSI recommendations. Full stop.
> 
> 
> I have written some text into the composite signatures draft that I think addresses this. It is currently on a github pull request:
> 
> https://github.com/EntrustCorporation/draft-ounsworth-composite-sigs/p
> ull/131
> 
> It adds the following text to the Introduction:
> 
> + In particular, certain jurisdictions are recommending or requiring that PQC lattice schemes only be used within in a PQ/T hybrid. As an example, we point to [BSI2021] which includes the following recommendation:
> 
> + "Therefore, quantum computer-resistant methods should not be used 
> + alone - at least in a transitional period - but only in hybrid mode, 
> + i.e. in combination with a classical method. For this purpose, 
> + protocols must be modified or supplemented accordingly. In addition, 
> + public key infrastructures, for example, must also be adapted"
> 
> + In addition, [BSI2021] specifically references this specification as a concrete example of hybrid X.509 certificates.
> 
> + A more recent example is [ANSSI2024], a document co-authored by 
> + French Cybersecurity Agency (ANSSI), Federal Office for Information 
> + Security (BSI), Netherlands National Communications Security Agency (NLNCSA), and Swedish National Communications Security Authority, Swedish Armed Forces which makes the following statement:
> 
> + “In light of the urgent need to stop relying only on quantum-vulnerable public-key cryptography for key establishment, the clear priority should therefore be the migration to post-quantum cryptography in hybrid solutions”
> 
> + This specification represents the straightforward implementation of the hybrid solutions called for by European cyber security agencies.
> 

That's about the closest I've ever seen to a pure argument from authority. I don't think we ought base IETF work on such a well known fallacy.

> 
> To flip the burden of proof back onto the detractors: 

I'm not currently being a detractor. I'm asking for someone to document a case where these hybrid signing algorithms are needed and needed now. If that's not doable then I find that fairly telling.

S.


> if you think that this work should not proceed, then please justify why the IETF does not need to produce a mechanism to fulfil this recommendation from multiple governments. Or perhaps the IETF already has a mechanism that satisfies this requirement, but if so, I am not aware of one -- for example all of the Multi-Cert mechanisms that I am aware of operate in an OR mode, and are therefore not "hybrids" as defined in the above-referenced BSI recommendations document.
> 
> ---
> Mike Ounsworth
> 
> -----Original Message-----
> From: Stephen Farrell <[e-mail]>
> Sent: Thursday, February 8, 2024 12:00 PM
> To: Mike Ounsworth <[e-mail]>; Kris Kwiatkowski 
> <[e-mail]>; [e-mail]
> Subject: Re: [EXTERNAL] Re: [lamps] 
> draft-ounsworth-pq-composite-sigs-11
> 
> 
> Hiya,
> 
> On 08/02/2024 15:31, Mike Ounsworth wrote:
>> Not to be flippant, but I think the answer is "everywhere".
> 
> You may be unsurprised to hear that I disagree.
> 
>> The current recommendations (at least from some European governments) 
>> are to not use lattice schemes in isolation, but only in hybrids. So 
>> anywhere that uses long-term keys (ex.: certs for CAs, S/MIME, Code 
>> Signing, Document Signing, any-other-thing Signing, etc) and wants to 
>> migrate to Dilithium *should* migrate to a dilithium+ecc or
>> dilithium+rsa composite.
>>
>> Would it address your comment if we add text to the Intro to that 
>> effect that references the various government calls for hybrids?
> 
> Not for me, no. Other agencies have recommended against hybrid KEMs by times, and we happily ignore that. We should also be doing the engineering work to determine what's needed where and when. So I think we need a demonstration that these kinds of hybrid signing algs are needed, and needed now. I've not seen that myself, especially in a context where pq signing algs seem to be evolving a lot.
> 
> S.
> 
>>
>> --- Mike Ounsworth
>>
>> -----Original Message----- From: Spasm <[e-mail]> On 
>> Behalf Of Stephen Farrell Sent: Wednesday, February 7, 2024 4:25 PM
>> To: Kris Kwiatkowski <[e-mail]>; [e-mail] Subject:
>> [EXTERNAL] Re: [lamps] draft-ounsworth-pq-composite-sigs-11
>>
>>
>> Hiya,
>>
>> On 07/02/2024 22:07, Kris Kwiatkowski wrote:
>>> * Is there a document describing real-world use cases for this draft?
>>> I’m aware of draft-vaira-pquip-pqc-use-cases, but really I’m looking 
>>> for use cases where draft-ounsworth-pq-composite-sigs will be 
>>> clearly very useful/necessary to have.
>>
>> I'd also be v. interested in that, and didn't find such text when I 
>> looked a few months back. (And I think such text is very much
>> needed.)
>>
>> Cheers, S.