[openpgp] Re: PQC: ML-DSA only (non-composite) signatu re

On 25 Jun 2025, at 23:11, Simo Sorce <[email protected]> wrote:
> 
> With disjoint signatures, once the classic ones are broken, you can
> more quickly remove support from crypto libraries for the broken
> algorithm, because all messages that are dual signed can still be
> verified with the sane signature.
> 
> With composites, generally, you are forced to keep the broken algorithm
> around

I don’t believe this makes much difference in practice. The composite signatures (and key material) in openpgp-pqc are only composite in the sense that both components are stored in adjacent fields in the same packet; no other relationship is imposed. [1] If a receiving implementation wanted to ignore one of the two signatures in the composite, this would be trivial. The libraries could be unilaterally removed from its codebase without affecting its ability to verify the sane component signature.

It would not be so easy to stop *generating* the broken component sig, due to rollout delay at the receiver, but this would be an issue in either scenario. In the case that one of the component algorithms is broken, we will need to keep generating it anyway for some time until all clients catch up, regardless of the implementation details.

A

[1] https://datatracker.ietf.org/doc/html/draft-ietf-openpgp-pqc-12#section-5.3.1

_______________________________________________
openpgp mailing list -- [email protected]
To unsubscribe send an email to [email protected]