[openpgp] Re: PQC: ML-DSA only (non-composite) signatu re

On Wed, 2025-06-25 at 10:49 +0200, Falko Strenzke wrote:
> I think it is difficult to come to a clear verdict whether the complexity is worth the gain. For software pure implementations, which I assume to be in the far majority in the case of OpenPGP, the added complexity is approximately to make one additional call to a key generation, signing, and verification function. As the main gain I would see that a policy for long-term secure signatures becomes a bit easier to enforce by requiring ML-DSA-composites.

First of all I just want to make clear that I accept the WG consensus
even if I do not agree with all aspects of the proposed standard.

Note, the main beef I have with composite signatures is that, like any
signature, they will tend to live much longer than encryption
algorithms exactly because people tend to have around old documents
they need/want to verify.

With disjoint signatures, once the classic ones are broken, you can
more quickly remove support from crypto libraries for the broken
algorithm, because all messages that are dual signed can still be
verified with the sane signature.

With composites, generally, you are forced to keep the broken algorithm
around, which then can be used for other things even though it
shouldn't, whether for incorrect configuration or malicious ignorance
(and not just by the PGP implementation, given crypto libraries are
often shared).

And as with all code it will require maintenance, including potential
security fixes etc...

I fully appreciate that the right balance can't be fully objective
because it can tilt both ways depending on various circumstances, but I
honestly see more severe downsides than beneficial upsides in this
case.

HTH,
Simo.

-- 
Simo Sorce
Distinguished Engineer
RHEL Crypto Team
Red Hat, Inc

_______________________________________________
openpgp mailing list -- [email protected]
To unsubscribe send an email to [email protected]