[Ssh] Re: PQ signatures - where do we want to end up?

[Peter Gutmann <[e-mail]>]

D. J. Bernstein <[e-mail]> writes:

>  "Cryptanalytic capabilities are now coming on line"

That's just handwaving, it doesn't tell you anything about what they're really
doing.  In particular people expect the NSA to do codebreaking so they say
they're doing codebreaking, and everyone's so busy focusing on that that no-
one notices that their Cisco routers have had supplementary functionality
added to them during the shipping process.  The NSA is reading our traffic?
Must be those cryptanalytic capabilities they keep going on about.  If you
look at the NSA Fun Toys catalogue, that was all crypto being bypassed, not
broken.

And as if on demand:

 https://copy.fail/

 The same 732-byte Python script roots every Linux distribution shipped since
 2017 [...] The kernel crypto API (AF_ALG) ships enabled in essentially every
 mainstream distro's default config, so the entire 2017 -> patch window is in
 play out of the box.

That's not just "Crypto is bypassed, not attacked", it's "It's the crypto that
enables the attack in the first place".

>  "Flame is the first known example of an MD5 collision attack being used
>   maliciously in a real-world environment"

Yup, that just shows how truly rare it is, an algorithm that was known at the
time to be insecure/broken for between ten and twenty years (depending on
whether you start the count at pseudocollisions or actual ones) still had no
attacks for, well, ten to twenty years.

Of the algorithm shopping list you gave, none of them are known to be broken
right now, let alone have been known to be broken for between ten and twenty
years.  So it's not asking someone to deploy or keep using a known-broken
algorithm as MD5 was, it's asking someone to deploy... I can't remember what
the whole list was but let's say a dozen different algorithms all of which
offer security that's identical as far as an attacker is concerned, in the
same way that AES-128, AES-192, and AES-256 are identical, SHA-256, SHA-384
and SHA-512 are identical, and ECDSA P256, P384, and P521 are identical -
there's no attack on any of them, and it's irrelevant whether you use -128,
-256, or -512 as far as the attacker is concerned.  You do however lose a fair
bit of performance and, in embedded, hardware support, if you go for the more
exotic options.

Thus my argument that all we need is a single combination, ML-DSA (the most
common/widely-supported) and Ed25519 (for when ML-DSA is broken).  You don't
need every exotic option under the sun just because this other one over there
has a slightly tighter bound on its mathematical proof.  The attackers won't
notice, or care.

Peter.