[openpgp] Re: PQC: ML-DSA only (non-composite) signatu re

On Mon, 2025-06-23 at 11:54 -0400, Daniel Kahn Gillmor wrote:
> On Mon 2025-06-23 07:23:57 +0200, Falko Strenzke wrote:
> > No such mechanism is necessary or makes sense at all. If the signer can 
> > tell the verifier what is a secure combination of signature algorithms, 
> > a malicious signer will specify a set of algorithms for which they can 
> > forge the signature. Or from a different perspective: how should the 
> > specification of the secure signature combinations itself be 
> > authenticated, as it is required prior to signature verification? Such a 
> > mechanism would be a severe security vulnerability.
> > 
> > I have seen this erroneous line of argument often during the 
> > multi-algorithm signature discussions. In fact, the verifier's policy 
> > has to require at least one signature algorithm that at verification 
> > time is secure. There is no alternative to that.
> 
> For the record, I agree with Falko on this.  This kind of complexity is
> probably dangerous, and seems unlikely to be useful. OpenPGP is simpler
> and clearer to application developers and implementers alike when one
> acceptable OpenPGP signature from any acceptable signer is sufficient
> for a message verification to succeed.
> 
> Doing anything more sophisticated than that (even if you try to avoid
> tricky multilateral negotiations between signers and verifiers) seems
> likely to push unmanageable complexity to the users of the standard.
> 
> See the discussion at
> https://gitlab.com/dkg/openpgp-stateless-cli/-/issues/104 for a
> similar/related situation.

While I agree I do not see how people go from this to the idea this
means composed signatures are required and do not consider those also
too complex.

Just put two pure signatures on a message and the client will decide
which one it trusts. If ML-DSA gets broken clients will stop trusting
it and verify only the pure classic one.

For encryption there is an inherent need to do hybrid algorithms
because there is an ongoing need to protect content that is out of your
hands once it is transmitted, but signatures are checked at specific
points in time, can always be rechecked and require no hybridization,
because once broken the broken part is effectively useless.

Hybrid/composite signatures just make everything more complicated for a
minuscule gain, which is to "protect" content for a little amount of
time while people update their client to stop trusting the broken
signature type. I do not think the added complexity is worth it at all.

-- 
Simo Sorce
Distinguished Engineer
RHEL Crypto Team
Red Hat, Inc

_______________________________________________
openpgp mailing list -- [email protected]
To unsubscribe send an email to [email protected]