[openpgp] PQC: ML-DSA only (non-composite) signature

Hi everyone! Cryptography newbie here, so this proposal might not make 
sense at this stage, but I think it's worth discussing :)

I also created a GitHub issue: 
https://github.com/openpgp-pqc/draft-openpgp-pqc/issues/220

The use case is: Signing messages and software using ML-DSA-87 to comply 
with CNSA 2.0 [1] (see "Table: Commercial National Security Algorithm 
Suite 2.0") using keys stored in an HSM.

In its current state, this draft forces us to use a composite signature 
ML-DSA-87+Ed448.

A significant portion of HSMs are not able to sign using Ed448.

In this particular use case, continuing to use RSA signing because of 
software/HSM compatibility reasons is a "must", so that means that 
triple signing would be needed (i.e. ML-DSA-87+Ed448 and RSA-4096). Also 
for compliance reasons with CNSA 1.0 [2].

Another concern is that, according to section 3.3 [3], "Newer 
implementations with PQ(/T) support MAY ignore the traditional 
signature(s) during validation." but there is no ML-DSA-only signature 
scheme defined.

Would it make sense to have an ML-DSA-87 only (non-composite) signature 
in this draft where you also advice to use it together with a classical 
signature algorithm but don't specify which one? (i.e. 2 independent 
OpenPGP signatures)

Beyond this particular use case, I believe it adds some flexibility to 
OpenPGP and makes it more future-proof.

Thank you!
Roberto.

[1] 
https://media.defense.gov/2022/Sep/07/2003071836/-1/-1/0/CSI_CNSA_2.0_FAQ_.PDF
[2] 
https://media.defense.gov/2021/Oct/15/2002874275/-1/-1/0/CNSA_WORKSHEET_20211015.PDF
[3] 
https://www.ietf.org/archive/id/draft-ietf-openpgp-pqc-11.html#name-multiple-signatures

_______________________________________________
openpgp mailing list -- [email protected]
To unsubscribe send an email to [email protected]