[TLS] Re: Composite ML-DSA

[Peter Gutmann <[e-mail]>]

Simon Josefsson <simon=[e-mail]> writes:

>If your protocol allows a man-in-the-middle attack, it is REALLY bad.

How many real-world MITM attacks on crypto protocols have there been?  By MITM
I don't mean swapping in a bogus cert for which the signature will verify just
fine whether it's hybrid or not, but real break-the-crypto MITM attacks.

Hint: Some years ago many major sites (Apple, Amazon, eBay, HP, PayPal,
Twitter, and many more) were using keys as weak as 384 bits for DKIM signing.
One third of all DKIM-using domains were using keys so weak a dedicated
individual could have broken them.  Despite the fact that the protocol, or at
least the way it was used, allowed a REALLY bad attack, no-one did.

So perhaps a better way of phrasing it is:

If your protocol allows a man-in-the-middle attack, it's a real pearl-clutcher.

Peter.