[TLS] Re: [EXT] Re: [Last-Call] <draft-ietf-tls-mldsa-03.txt> (Use of ML-DSA in TLS 1.3) to Informational RFC

[Brian E Carpenter <[e-mail]>]

John, I appreciate your clarifications, I really do. It all serves to show why we need an accessible exposition of these issues for the non-expert readers of the relevant RFCs.

Regards/Ngā mihi
    Brian Carpenter

On 27-May-26 18:47, John Mattsson wrote:
> Brian E Carpenter wrote:
>  >The 'significantly harder' argument, which requires that independence, is that if the probablity of one being broken over the next n years is p, and the probability of the other being broken over the next n years is q, then the probability of both being broken is pq.
> 
> Why do you insist on making comparisons to basic mathematical operations that do not apply to cryptographic compositions?
> 
> - If the probability of finding a distinguishing attack on encryption algorithm A is p, and the probability of finding a distinguishing attack on an independent encryption algorithm B is q, then the probability of finding a distinguishing attack on the composition B(A(P)) is not pq. Depending on the algorithms and the composition method, the probability can clearly be q, or smaller than pq.
> 
> - Similarly, if the probability of finding a malleability attack on EdDSA is p, and the probability of finding a malleability attack on ML-DSA is q, then the probability of finding a malleability attack on draft-ietf-lamps-pq-composite-sigs is not pq, it is 1.
> 
> Cryptographic composition is fundamentally different from ordinary arithmetic. Security properties do not combine linearly, multiplicatively, or even monotonically. Composing two schemes can preserve security, weaken security, destroy specific security properties entirely, or introduce completely new attack surfaces. That is precisely why simplistic analogies to addition or multiplication are misleading in this context.
> 
> Cheers,
> John Preuß Mattsson
> 
>