Subject: Re: [COSE] Comments on draft-ietf-cose-hash-sig-01

From: Russ Housley <[email-masked]>
Date: Mon, 29 Apr 2019 18:52:53 -0400

John:

I was revisiting an old comment from you.

> - Section 1.1: I think some short info on the threat from Shor's algorithm would be good. I don't think [BH2013] talked about quantum computers.

There are two major points in this section: advances in cryptanalysis and advances in the development of quantum computers.  The presentation in [BH2103] is about advances in cryptanalysis, not quantum computers.

Does this make that more clear?

   There have been recent advances in cryptanalysis and advances in the
   development of quantum computers.  Each of these advances pose a
   threat to widely deployed digital signature algorithms.

   At Black Hat USA 2013, some researchers gave a presentation on the
   current state of public key cryptography.  They said: "Current
   cryptosystems depend on discrete logarithm and factoring which has
   seen some major new developments in the past 6 months" [BH2013].  Due
   to advances in cryptanalysis, they encouraged preparation for a day
   when RSA and DSA cannot be depended upon.

   Peter Shor showed that a large-scale quantum computer could be used
   to factor a number in polynomial time [S1997], effectively
   breaking RSA.  If large-scale quantum computers are ever built, these
   computers will be able to break many of the public-key cryptosystems
   currently in use.  A post-quantum cryptosystem [PQC] is a system that
   is secure against quantum computers that have more than a trivial
   number of quantum bits (qu-bits).  It is open to conjecture when it
   will be feasible to build such computers; however, RSA, DSA, ECDSA,
   and EdDSA are all vulnerable if large-scale quantum computers come to
   pass.

   The HSS/LMS signature algorithm does not depend on the difficulty of
   discrete logarithm or factoring, as a result these algorithms are
   considered to be post-quantum secure.

Thanks,
  Russ

---

From: Stephen Farrell <[email-masked]>
Date: Tue, 30 Apr 2019 00:04:12 +0100

Hi Russ,

Sorry, I hadn't read this 'till just now, when the
text below made me wonder.

I don't get the logic for including most of the text
in this draft (other than section 3, the samples and
IANA stuff).

Why would this draft be introducing Shor and LMS etc?
That seems like a thing to be done by reference only.
(It may make sense for the draft to include this text
but for it to not be in an eventual RFC I guess.)

S.

On 29/04/2019 23:52, Russ Housley wrote:
> _______________________________________________
> COSE mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/cose
>

---

From: Russ Housley <[email-masked]>
Date: Tue, 30 Apr 2019 07:37:17 -0400

Stephen:

This section is just offering the reason for someone to implement hash-based signatures.

Russ

> On Apr 29, 2019, at 7:04 PM, Stephen Farrell <[email-masked]> wrote:
> 
> Hi Russ,
>

---

From: Stephen Farrell <[email-masked]>
Date: Tue, 30 Apr 2019 12:54:16 +0100

Hiya,

> This section is just offering the reason for someone to implement

Sure. I'd suggest not leaving that in the RFC though,
otherwise you may end up adding the same text every
time you wanna define anything related to hash based
sigs, and that text will likely get outdated I'd guess.

S.

>> Sorry, I hadn't read this 'till just now, when the text below made
>> me wonder.
>> 
>> I don't get the logic for including most of the text in this draft
>> (other than section 3, the samples and IANA stuff).
>> 
>> Why would this draft be introducing Shor and LMS etc? That seems
>> like a thing to be done by reference only. (It may make sense for
>> the draft to include this text but for it to not be in an eventual
>> RFC I guess.)
>> 
>> S.
>> 
>> 
>>>> - Section 1.1: I think some short info on the threat from
>>>> Shor's algorithm would be good. I don't think [BH2013] talked
>>>> about quantum computers.
>>> 
>>> There are two major points in this section: advances in
>>> cryptanalysis and advances in the development of quantum
>>> computers.  The presentation in [BH2103] is about advances in
>>> cryptanalysis, not quantum computers.
>>> 
>>> There have been recent advances in cryptanalysis and advances in
>>> the development of quantum computers.  Each of these advances
>>> pose a threat to widely deployed digital signature algorithms.
>>> 
>>> At Black Hat USA 2013, some researchers gave a presentation on
>>> the current state of public key cryptography.  They said:
>>> "Current cryptosystems depend on discrete logarithm and factoring
>>> which has seen some major new developments in the past 6 months"
>>> [BH2013].  Due to advances in cryptanalysis, they encouraged
>>> preparation for a day when RSA and DSA cannot be depended upon.
>>> 
>>> Peter Shor showed that a large-scale quantum computer could be
>>> used to factor a number in polynomial time [S1997], effectively 
>>> breaking RSA.  If large-scale quantum computers are ever built,
>>> these computers will be able to break many of the public-key
>>> cryptosystems currently in use.  A post-quantum cryptosystem
>>> [PQC] is a system that is secure against quantum computers that
>>> have more than a trivial number of quantum bits (qu-bits).  It is
>>> open to conjecture when it will be feasible to build such
>>> computers; however, RSA, DSA, ECDSA, and EdDSA are all vulnerable
>>> if large-scale quantum computers come to pass.
>>> 
>>> The HSS/LMS signature algorithm does not depend on the difficulty
>>> of discrete logarithm or factoring, as a result these algorithms
>>> are considered to be post-quantum secure.
>>> 
>>> Thanks, Russ
> 
> 
> _______________________________________________ COSE mailing list 
> [email-masked] https://www.ietf.org/mailman/listinfo/cose
>

---

From: Russ Housley <[email-masked]>
Date: Tue, 30 Apr 2019 10:22:35 -0400

I can drop Section 1.1 if others think that is the best way forward.  I think this document is ready for WG Last Call.  Maybe we can explictly ask whether Section 1.1 should be kept or dropped.

Russ

> On Apr 30, 2019, at 7:54 AM, Stephen Farrell <[email-masked]> wrote:
> 
> Signed PGP part
> 
> Hiya,
> 
> <0x5AB2FAF17B172BEA.asc>