[saag] Re: [EXTERNAL] post quantum guidance draft

Stephen Farrell wrote:
>I think we won't know what guidance to offer for signatures for a year or two more, or maybe even longer.
>Do nothing for now on signatures


I think standalone and hybrid signatures should be discussed separately. For hybrid signatures, I mostly agree with the points made above. For standalone signatures, I do not. In particular, for long-lived trust anchors, hardware devices, and digital contracts, areas where IETF standards are often used, a recommendation to “wait” would be dangerous. TLS WG has adopted ML-DSA and stated that dual certs/comp sigs will be "much later", which I think is the correct approach. For other use cases SLH-DSA, LMS, and XMSS might be suitable.
https://datatracker.ietf.org/meeting/123/materials/slides-123-tls-wg-status-00


Standalone:
-------------------
Theoretically, I strongly prefer ML-DSA over RSA. I agree with Sophie’s statement that “my trust in lattice cryptography is pretty much equal to my trust in elliptic curves, and quite a bit higher than my trust in RSA,”. I think everyone should read her blog:
https://keymaterial.net/author/sophieschmieg/


From an implementation standpoint, I don’t expect ML-DSA implementations to be worse than many existing RSA or ECDSA implementations. In practice, many RSA and ECDSA implementations fail to follow any modern standard. ML-DSA may actually improve the situation by providing a single, well-defined specification (FIPS 204), whereas RSA and ECDSA suffer from an excess of specifications.


Hybrids:
-------------------
Hybrid signatures, like hybrid KEMs, should preserve the security properties of their components. For future deployments of PQ/T hybrids, this means maintaining the security of the PQ algorithm, since RSA and ECC should not be considered to provide any meaningful security beyond 2035.


For ML-DSA hybrids, it is therefore essential that the construction preserves the SUF-CMA security of ML-DSA. EUF-CMA signatures often lead to availability and replay vulnerabilities at the system level. The critical importance of SUF-CMA has been highlighted by recent IETF discussions, in which several participants mistakenly argued that their use cases required only EUF-CMA security.


Much of the discussion on hybrids over the past decade is now outdated, as it focused on preserving the properties of RSASSA-PKCS1-v1_5 and ECDSA during the transition to PQC. These discussions largely overlooked the fact that all modern signature schemes (LMS, XMSS, EdDSA, ML-DSA, SLH-DSA, and FN-DSA) are believed to offer a a high level of SUF-CMA security, while RSA and ECC have trivial SUF-CMA attacks. I believe separability has been given disproportionately more attention compared to other important properties.


In general, the IETF should recommend against deploying PQ/T hybrids that do not preserve the security properties of the PQ signature. If such hybrids are nevertheless deployed, it is essential that they be disabled by 2035. As an alternative to changing algorithms, the simple hybrid signature mechanism described in Annex B.3.1 of ETSI TR 103 966, using independent fields rather than concatenation, can be used, with the traditional component disabled/removed by 2035.
https://www.etsi.org/deliver/etsi_tr/103900_103999/103966/01.01.01_60/tr_103966v010101p.pdf


In general, I consider the following three types of PQ/T hybrids acceptable for new deployments with a lifetime beyond 2035:
- Hybrids that preserve the security properties of both components.
- Hybrids that preserve the security property of the PQ component.
- Hybrids where the traditional part can be removed during a transition to a standalone PQ signature.


In addition to offering no meaningful security beyond 2035, RSA signing is also significantly slower than ML-DSA for short messages.
https://blog.cloudflare.com/pq-2025/#the-zoo-of-post-quantum-signatures


Cheers,
John Prueß Mattsson

_______________________________________________
saag mailing list -- [email protected]
To unsubscribe send an email to [email protected]