[lamps] Re: [EXTERNAL] WG Last Call for draft-ietf-lamps-kyber-certificates-07

[Alicja Kario <[e-mail]>]

We do have top level specifications in PKIX, like rfc5280.
But none of them have ever specified mandatory to implement PKI algorithms.
That's a thing for protocols that use X.509.

So, no, as Russ said, this specification does not specify ML-KEM as a
mandatory to implement algorithm within IETF.

On Monday, 13 January 2025 02:48:06 CET, Mike Ounsworth wrote:
> I agree that the concept of “Mandatory-to-implement” within 
> IETF X.509 behaves a bit differently than MTI in other WGs.
>  
> As Russ says, there is no global “Every X.509 or CMS 
> implementation MUST support X”.
>  
> But I think what Dan is getting at has a kernel of truth to it 
> also: a given LAMPS specification can contain both mandatory and 
> optional components. For example, draft-ietf-lamps-cms-kyber 
> says “A compliant implementation MUST support HKDF with SHA-256” 
> as the KEMRecipientInfo.KDF – so *IF* you implement ML-KEM 
> within CMS, then it is mandatory to implement HKDF-SHA256, *BUT* 
> you are allowed to implement CMS without implementing ML-KEM. 
> MTI within this draft, but not globally MTI for CMS. It’s weird. 
> My brain hurts now.
>  
> ---
> Mike Ounsworth
>  
> From: Russ Housley <[e-mail]> 
> Sent: Sunday, January 12, 2025 11:09 AM
> To: Dan Bernstein <[e-mail]>
> Cc: [e-mail]; [e-mail]
> Subject: [EXTERNAL] [lamps] Re: WG Last Call for 
> draft-ietf-lamps-kyber-certificates-07
>  
> Dan: >> This is not a mandator-to-implement algorithm. If one 
> chooses to >> implement this specification, then that 
> implementer will obviously >> need to implement ML-KEM. > > That 
> makes the algorithm mandatory to implement. 
> Dan:
>  
>>> This is not a mandator-to-implement algorithm.  If one chooses to
>>> implement this specification, then that implementer will obviously
>>> need to implement ML-KEM.
>> 
>> That makes the algorithm mandatory to implement.
>  
> We disagree on a vey fundamental level. The PKIX WG and the 
> LAMPS WG have been very clear that there are no 
> mandatory-to-implement algorithms in the PKI specifications.  
> Rather, othr WGs that specify protocols that make use of PKI can 
> make algorithms selections.  For example, S/MIME and TLS are two 
> protocols that use PKI.  S/MIME 4.0 (RFCs 8550 and 8551) 
> includes statements about mandatory-to-implement algorithms.  
> The TLS 1.3 (RFC 8446) includes statements about 
> mandatory-to-implement algorithms. 
>  
> Russ

-- 
Regards,
Alicja (nee Hubert) Kario
Principal Quality Engineer, RHEL Crypto team
Web: www.cz.redhat.com
Red Hat Czech s.r.o., Purkyňova 115, 612 00, Brno, Czech Republic