[openpgp] Re: PQC: ML-DSA only (non-composite) signatu re

Andrew Gallagher <[email protected]> Wed, 25 Jun 2025 09:46:09 +0100

Newsgroups	gmane.ietf.openpgp
Message-ID	<[email protected]>

On 25 Jun 2025, at 09:20, Simo Sorce <[email protected]> wrote:
> 
> For encryption there is an inherent need to do hybrid algorithms
> because there is an ongoing need to protect content that is out of your
> hands once it is transmitted, but signatures are checked at specific
> points in time, can always be rechecked and require no hybridization,
> because once broken the broken part is effectively useless.

For document signatures, you have a point. For self-signatures it is more complex.

You can only have one primary key per certificate, so in order to make a post-quantum safe certificate you need a composite primary key so that the certificate itself remains secure under both the PQ and ECC failure scenarios. Otherwise, we’re asking people to manage two sets of keys/certificates in parallel at all times, which is much more fragile from both an implementation and operational POV.

Once we admit composite primary keys, it is conceptually easier to also define composite signatures so that we maintain a 1:1 mapping between key algorithms and signature algorithms. While this does not improve the security properties, it has the advantage of not requiring changes to the higher-level logic, meaning that it is harder for the application layer to screw it up.

A

_______________________________________________
openpgp mailing list -- [email protected]
To unsubscribe send an email to [email protected]

signature.asc (application/pgp-signature, 833 B)