[saag] Re: post quantum guidance draft

Simon Josefsson <[email protected]> Fri, 12 Dec 2025 09:17:59 +0100

Newsgroups	gmane.ietf.saag
Message-ID	<[email protected]>

Watson Ladd <[email protected]> writes:

>> Many people dislike the multiplicative impact of, for example, the
>> three sizes of ML-DSA.  Me too. It’s unfortunate that they’re made
>> explicit. RSA, for example, uses the same identifiers no matter the
>> key size, so I’m not sure it’s right to count that as an argument
>> against PQ por PQ/T signatures.
>
> To adapt an old joke about Baptists (or Trotskyists)
> "We support RSA"
> "Oh me too. RSA-1025, RSA-2048 or RSA-4096"
> "RSA-2048"
> "RSA-PSS or RSA-PKCS 1.5"
> "RSA-PSS"
> "Salt length equal to hash or maximal"
> "Maximal"
> "Interop failure"
>
> Having explicit indicators makes providing good error messages easier
> for programmers, which then helps  adminstrators and users.

+1

I believe the (rarely written down) acquired wisdom is to not
parametrize cryptographic algorithms, and have stable identifiers locked
down to particular parameter choices, and have as few of those stable
identifiers for the same underlying algorithm as possible.

In fact, in reverse, I would argue that a succesful method to weaken
crypto in practice is to insist on parametrization and to have multiple
identifiers for the same algorithm.  This leads to parametrized
implementations, which make them less performant and more complex and as
a result weaker.  The CFRG treatment to Ed25519 is one example of this.

Good:

sntrup761x25519
SLH-DSA-SHAKE-128S
X25519MLKEM768

Bad:

ML-DSA-44
ML-DSA-65
ML-DSA-87
RSA OID with ASN.1 struct with parameter

This is the approach promoted by Chempat and Mothma:

https://datatracker.ietf.org/doc/html/draft-josefsson-chempat
https://datatracker.ietf.org/doc/html/draft-josefsson-cfrg-mothma

/Simon

_______________________________________________
saag mailing list -- [email protected]
To unsubscribe send an email to [email protected]

signature.asc (application/pgp-signature, 1.2 KB)