[openpgp] PQC composite sig context string? [was: Re: Re: AD review of draft-ietf-openpgp-pqc-12]

Thanks for this cleanup work, Aron and the rest of the authors.  The
draft is better for Paul's review and for your responses to it.

I just wanted to draw the WG's attention to this open question which has
the potential to invalidate existing implementations and test vectors:

On Tue 2025-09-23 15:08:17 +0000, Aron Wussler wrote:
>> Section 5.1.2. ML-DSA Signatures
>
>> Why is the context string empty and not set to "OpenPGP" or something? Wouldn't
>> this strengthen against cross protocol attacks?
>
> This was decided because of library support, that has since partly changed.
> Full discussion here: https://github.com/openpgp-pqc/draft-openpgp-pqc/issues/231
>
> I personally oppose wire format changes at this stage if not
> necessary, especially given this would still give implementation
> headaches with Botan and delay adoption by months.

Paul, the consensus of the WG was OK with the decision to omit the
context string in the past, but that was due in part to limitations in
underlying crypto libraries, some of which now do support the context
string for ML-DSA and SLH-DSA.

WG, we need to make a decision between these two choices:

A) Retain the old consensus (and move forward with the draft and test
    vectors as planned, perhaps noting in the draft the historical
    reason for the empty context string), or

B) Select a context string (invalidating existing test vectors and
     implementation branches)

Please give feedback on the list here about whether you prefer A or B.

If you prefer B, please also indicate whether you are OK with the fixed
context string "OpenPGP", or if you prefer some other context string.

We can see from Aron's message that he prefers A.

Please respond in the coming week so we can move this draft along.

Regards,

        --dkg

_______________________________________________
openpgp mailing list -- [email protected]
To unsubscribe send an email to [email protected]

-----BEGIN PGP SIGNATURE-----

iHUEARYKAB0WIQRjrBGOWy5dZsiKhad4C4VO2cK0lgUCaNQh/gAKCRB4C4VO2cK0
lvWcAP4kf4265KMTI3FL9vN9ta9TEMVw3i5W8Q62a77CdMSbzQEA/eWBjM709ein
NUV/+hT9FXxLoMRuNtShknUaIPv8ZgA=
=eTco
-----END PGP SIGNATURE-----