[TLS] Re: Composite ML-DSA

[[e-mail]]

Hi,
 
I'd like to add a perspective on why hybrid certificates and authentication are useful. My background is with IoT and OT (operational technology) devices manufactured by medium-sized businesses. These devices often maintain a connection to the manufacturer's backend, mutually authenticated by small scale private PKIs (plural, because device certificates and backend certificates are under different roots).
 
The deployment of these devices has the unfortunate property that between production and first installation a lot of time can pass, sometimes upwards of a year. With IoT, this can be because the devices are stored in a crate or a shelf somewhere along the retail chain, with OT, operators keep devices in storage for hot swapping in case of hardware failures for any of the deployed devices.
 
The transition from traditional to post-quantum authentication methods poses a significant problem for these device classes. In many other scenarios, you can flip the switch from ECDSA-based authentication to ML-DSA-based authentication the moment you judge the CRQC threat as too high by pushing a config or software/firmware update. (This requires that PQ-keys/-certificates have been distributed beforehand, of course.) But devices lying in storage have no active internet connection to receive that information. When they authenticate the backend many months later, for the first time in over a year, the ECDSA keys might have been compromised already. (Under the assumption that attacks against EC keys are widely available soon. I'm still somewhat on the fence about that in regard to targets that don't have extremely high value.)
 
One way around that dilemma is to do an initial check on whether authentication should be switched over, by connecting to a special endpoint once with ECDSA certificates and once with ML-DSA certificates and verify that both give the same advice (and abort if they don't). But from an operational perspective, issuing hybrid certificates as soon as possible and just using those for mutual TLS seems to be the easiest and most robust solution.
 
(Now, there are a lot of hurdles along the way. Most notably, secure elements (and cellular modems with TLS stacks) are still widely missing ML-DSA support (or SLH-DSA for that matter), but we have that problem with non-composites as well.)
 
What are your thoughts on that? Do you know of a more straightforward solution? Relying only on ML-DSA as soon as possible is problematic, both because of customer concern and regulatory requirements.
 
Best regards,
Tim Beckmann