[TLS] Re: Composite ML-DSA

[Peter Gutmann <[e-mail]>]

Wang Guilin <Wang.Guilin=[e-mail]> writes:

>Your above example just shows that a composites is as strong as the stongest
>link, rather than the weakest link. And exactly, this is the main merit of
>hybrid/composite.

We're talking about different things.  In terms of security, Apples+Oranges is
no better than Apples || Oranges [0], if one fails then you're relying
entirely on the other one.

However I'm talking about code changes and latency for fixes.  If Apples fails
with Apples || Oranges you just make it Grapes || Oranges, or carry on with
Oranges only, or if you're really paranoid you start off with Grapes || Apples
|| Oranges and use majority voting [1].  If it fails with Apples+Oranges then
you have to invent a new composite Grapes+Oranges and get the code points
assigned and get the composite deployed.  I'm not worried about Apples *and*
Oranges being broken, I'm worried about the amount of effort involved to patch
things up when one of the two is broken and the two are inextricably tied
together in a fruit salad rather than being two independent things where each
will stand on their own.

Peter.

[0] Meaning there's some theoretical stuff you can claim but I can't see
    anything that would bother real-world attackers.
[1] If TLS adopts this then I claim dibs.