[TLS] Re: Working Group Last Call for Use of ML-DSA in TLS 1.3

[Peter Gutmann <[e-mail]>]

Scott Fluhrer (sfluhrer) <sfluhrer=[e-mail]> writes:

>Tim, you might be happy with cryptography that is sufficient against the
>local Wifi provider.  Some of us deal with scenarios where nation-state
>actors are a legitimate threat.  I believe that this working group needs to
>keep that in mind.

My code is deployed in situations where nation-state attacks are expected.
The approach there is to assume that if they really want to get in they'll get
in no matter what you do and plan accordingly through defence in depth, other
controls, and so on.  There is no expectation that the crypto alone will stop
them, because Shamir's Law always wins in the end.

So a better question would be, are we trying to create a practical,
realistically-deployable system or, to paraphrase Bowen and Hinchey's long-ago
comment in IEEE Software, engage in mental masturbation for cryptographers?

>Also, attacks against authentication need not involve MITM - another approach
>would be an impersonation attack,

Like phishing for example?  The thing that just keeps on working no matter how
much and what flavour of crypto we use?

Peter.