Re: [lamps] Multiple drafts with PQ algorithm key encodings that are not compatible.

[Russ Housley <[e-mail]>]

Trimming the recipient list because the other messages needed moderation for "too many recipients"

draft-uni-qsckeys-01 makes the argument that for the private keys, one size does not fit every use case.  If there is consensus on this view, thenOPTIONAL fields or a CHOICE within the private key structure seems like a simple way forward.

I was really hoping that the public key would _always_ be an OCTET STRING.  No optional parts. 

Russ


> On Sep 28, 2022, at 2:33 PM, John Gray <John.Gray=[e-mail]> wrote:
> 
> We are doing some interoperability testing with different vendors using the new Dilithium, Falcon and SPHINCS+ algorithms.   We have come across at least two drafts which are trying to specify the ASN.1 encoding formats for these algorithms.   However, the encoding formats are not compatible with each other.   I imagine the authors of these drafts should get together and come up with a common format (I have copied them on this email).   This means we must choose one or the other, or even worse, support multiple formats (which can lead to bugs).   Initially I started more than a year ago using my own encoding format for internal prototyping, but now need to interoperate with others outside of our organization, so a common format is definitely needed at this point.   😊
>  
> We fully realize the OID values will be changing once official OIDs are registered, (changing those are trivial), but the ASN.1 formats of the public and private keys is kind of important as well…  😊
>  
> For example:
>  
> The LAMPS group has a specification of Dilithium public keys in this draft:
> https://datatracker.ietf.org/doc/draft-massimo-lamps-pq-sig-certificates/ <https://datatracker.ietf.org/doc/draft-massimo-lamps-pq-sig-certificates/>
>  
> the public key format is this:
>  
> The Dilithium public key MUST be encoded using the ASN.1 type
>    DilithiumPublicKey:
>  
>      DilithiumPublicKey ::= OCTET STRING
>  
> The private key format is this:
>  
>      DilithiumPrivateKey ::= SEQUENCE {
>          rho         BIT STRING,         - nonce/seed
>          K           BIT STRING,         - key/seed
>          tr          BIT STRING,         - PRF bytes (CRH in spec.)
>          s1          BIT STRING,         - vector l
>          s2          BIT STRING,         - vector k
>          t0          BIT STRING,         - encoded vector
>          PublicKey   IMPLICIT DilithiumPublicKey OPTIONAL
>      }
>  
>  
> In this draft:
> https://datatracker.ietf.org/doc/draft-uni-qsckeys/01/ <https://datatracker.ietf.org/doc/draft-uni-qsckeys/01/>
>  
> Dilithium keys have this encoding:
>  
>  
>    DilithiumPublicKey ::= SEQUENCE {
>        rho         OCTET STRING,
>        t1          OCTET STRING
>    }
>  
>  
>   DilithiumPrivateKey ::= SEQUENCE {
>        version     INTEGER {v0(0)}     -- version (round 3)
>        nonce       BIT STRING,         -- rho
>        key         BIT STRING,         -- key/seed/D
>        tr          BIT STRING,         -- PRF bytes (CRH in spec)
>        s1          BIT STRING,         -- vector(L)
>        s2          BIT STRING,         -- vector(K)
>        t0          BIT STRING,
>        publicKey  [0] IMPLICIT DilithiumPublicKey OPTIONAL
>                                        -- see next section
>    }
>  
> The draft-uni-qsckeys does not cover SPHINCS+,  it does cover Falcon, but I don’t know of another draft that specifies Falcon.
>  
> There are also encodings for Kyber mentioned in two documents that I see.  There is an early   https://datatracker.ietf.org/doc/draft-ietf-lamps-kyber-certificates/ <https://datatracker.ietf.org/doc/draft-ietf-lamps-kyber-certificates/>  draft which mentions it is up to the document defining Kyber to give more details.    In the draft-uni-qsckeys draft it is more specific.    
>  
> https://datatracker.ietf.org/doc/draft-uni-qsckeys/01/ <https://datatracker.ietf.org/doc/draft-uni-qsckeys/01/>
>  
>    KyberPrivateKey ::= SEQUENCE {
>        version     INTEGER {v0(0)}   -- version (round 3)
>        s           OCTET STRING,     -- sample s
>        publicKey   [0] IMPLICIT KyberPublicKey OPTIONAL,
>                                      -- see next section
>        hpk         OCTET STRING      -- H(pk)
>        nonce       OCTET STRING,     -- z
>    }
>  
> Partial public key encoding:
>  
> KyberPrivateKey ::= SEQUENCE {
>        version     INTEGER {v0(0)}   -- version (round 3)
>        s           OCTET STRING,     -- EMPTY
>        publicKey   [0] IMPLICIT KyberPublicKey OPTIONAL,
>                                      -- see next section
>        hpk         OCTET STRING      -- EMPTY
>        nonce       OCTET STRING,     -- d
>    }
>  
> Full public key encoding:
>  
>    KyberPublicKey ::= SEQUENCE {
>        t           OCTET STRING,
>        rho         OCTET STRING
>    }
>  
> Is https://datatracker.ietf.org/doc/draft-uni-qsckeys/01/ <https://datatracker.ietf.org/doc/draft-uni-qsckeys/01/> meant to become the document that defines the key formats for all the PQ keys that will be standardized?    If not, then it should probably just refer to whatever documents will define the formats so that we can at least agree on one common format for the PQ keys.
>  
>  
> Cheers,
>  
> John Gray
> Entrust
> Any email and files/attachments transmitted with it are confidential and are intended solely for the use of the individual or entity to whom they are addressed. If this message has been sent to you in error, you must not copy, distribute or disclose of the information it contains. Please notify Entrust immediately and delete the message from your system.
> _______________________________________________
> Spasm mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/spasm