Subject: Re: [Curdle] call for adoption for draft-mu-curdle-ssh-xmss-00

From: "Hammell, Jonathan F" <[email-masked]>
Date: Thu, 28 Nov 2019 19:59:53 +0000

Classification: UNCLASSIFIED

Hash-based signature schemes, such as XMSS, are appropriate for use cases where a limited number of signing operations will take place (due to the tree-based structure and high cost of signature generation) and those signatures will be validated far in the future (requiring the quantum-safe property).  Signing for SSH connections does not fit this model.  Furthermore, as others have pointed out, there are many concerns with managing the state of the private key in typical SSH scenarios.

I only see security concerns with using XMSS in SSH and no strong advantages.  Therefore, I am opposed to adoption.

Jonathan
--
Canadian Centre for Cyber Security

> Daniel Migault <[email-masked]> Wed, 20 November 2019 14:38 UTCShow header
>
> Hi,
>
> This mail starts a call for adoption for draft-mu-curdle-ssh-xmss-00 XMSS
> public key algorithms for the Secure Shell (SSH) protocol. Please state on
> the mailing list whether you support the adoption of the draft or if you
> have any objection by December 5.
>
> Yours,
> Rich and Daniel
>
> [1] https://datatracker.ietf.org/doc/draft-mu-curdle-ssh-xmss/

---

From: Stephen Farrell <[email-masked]>
Date: Fri, 29 Nov 2019 11:10:51 +0000

On 28/11/2019 19:59, Hammell, Jonathan F wrote:
> Hash-based signature schemes, such as XMSS, are appropriate for use
> cases where a limited number of signing operations will take place
> (due to the tree-based structure and high cost of signature
> generation) and those signatures will be validated far in the future
> (requiring the quantum-safe property).  Signing for SSH connections
> does not fit this model.  Furthermore, as others have pointed out,
> there are many concerns with managing the state of the private key in
> typical SSH scenarios.
> 
> I only see security concerns with using XMSS in SSH and no strong
> advantages.  Therefore, I am opposed to adoption.
> 

I think the above seems correct. I also hope that SSH
implementers don't adopt stateful signature schemes.

S

PS: Anyone know if [email-masked] still active or if
some other list has superseded that?

> Jonathan -- Canadian Centre for Cyber Security
> 
>> This mail starts a call for adoption for
>> draft-mu-curdle-ssh-xmss-00 XMSS public key algorithms for the
>> Secure Shell (SSH) protocol. Please state on the mailing list
>> whether you support the adoption of the draft or if you have any
>> objection by December 5.
>> 
>> Yours, Rich and Daniel
>> 
> _______________________________________________ Curdle mailing list 
> [email-masked] https://www.ietf.org/mailman/listinfo/curdle
>

---

From: Daniel Migault <[email-masked]>
Date: Fri, 29 Nov 2019 13:11:33 +0000

-----Original Message-----
From: Curdle <[email-masked]> On Behalf Of Stephen Farrell
Sent: Friday, November 29, 2019 6:11 AM
To: Hammell, Jonathan F <[email-masked]>; [email-masked]' <[email-masked]>
Subject: Re: [Curdle] call for adoption for draft-mu-curdle-ssh-xmss-00

> advantages.  Therefore, I am opposed to adoption.

I think the above seems correct. I also hope that SSH implementers don't adopt stateful signature schemes.

S

PS: Anyone know if [email-masked] still active or if some other list has superseded that?

<mglt>For what I know, I think it is still active. </mglt>

>> draft-mu-curdle-ssh-xmss-00 XMSS public key algorithms for the Secure 
>> Shell (SSH) protocol. Please state on the mailing list whether you 
>> support the adoption of the draft or if you have any objection by 
>> December 5.
>> 
>> Yours, Rich and Daniel
>>

---

From: Stephen Farrell <[email-masked]>
Date: Fri, 29 Nov 2019 13:37:03 +0000

Hiya,

> <mglt>For what I know, I think it is still active. </mglt>

Might be worth forwarding on the adoption call there as
well to see if you get additional feedback.

Cheers,
S.

---

From: "Salz, Rich" <[email-masked]>
Date: Fri, 29 Nov 2019 18:13:23 +0000

Is there anyone in favor of adoption beyond the original submitters?  Please speak up now.

---

From: denis bider <[email-masked]>
Date: Fri, 29 Nov 2019 21:33:50 -0600

I have been convinced by others' feedback that the safe use of a stateful
signature scheme in SSH would require the state to be encapsulated in a
dedicated authentication device. This could be (not limited to) a USB token
or a TPM. It's clear that such a device could exist, but does not currently
exist, and the IETF process would require it to exist in order to proceed
with standardization.

On Fri, Nov 29, 2019 at 12:13 PM Salz, Rich <[email-masked]> wrote:

> [email-masked]
> https://www.ietf.org/mailman/listinfo/curdle
>