Subject: [lamps] KEM-only certificates (KEMTLS)

From: Mike Ounsworth <[email-masked]>
Date: Thu, 28 Jan 2021 21:58:32 +0000

TL;DR: No immediate action, but something to keep an eye on.

I did not spend time on this during my talk today because I didn't want to distract from the Composite topic, but I want to draw attention to my "Bonus topic" slide about KEM certificates. I don't know if anyone else is following the KEMTLS discussions (references below), but that would require PKIs to issue large amounts of Key Establishment Mechanism (KEM; aka keyUsage: keyEncipherment) TLS certificates. If TLS WG decides to adopt the KEMTLS draft, then LAMPS probably needs to take a look at PKIX to make sure we can handle enrollment, update, revocation for clients that don't have signing keys. I took a (very) quick pass over CMP, Lightweight CMP, EST (both simple and full-CMC) and attempted to summarize findings in my "bonus topics" slides.

1: My slides from today: https://datatracker.ietf.org/meeting/interim-2021-lamps-01/materials/slides-interim-2021-lamps-01-sessa-position-presentation-by-mike-ounsworth-00.pdf
2: "Post-quantum TLS without handshake signatures", Schwabe, Stebila, Wiggers, https://eprint.iacr.org/2020/534
3: "KEMTLS: Post-quantum TLS without signatures", Celi, Wiggers, https://blog.cloudflare.com/kemtls-post-quantum-tls-without-signatures/

---
Mike Ounsworth
Software Security Architect, Entrust

---

From: "Panos Kampanakis (pkampana)" <[email-masked]>
Date: Fri, 29 Jan 2021 03:52:51 +0000

Hopefully we will get to discuss KEMTLS if the Cloudflare folks bring this
to the TLS WG. 

KEM-TLS is a neat idea, but not as easy as swapping a Sig with a KEM in the
leaf cert. If it was swapping (EC)DSA with (EC)DH as a KEM, then it would be
trivial as proposed in
https://tools.ietf.org/html/draft-ietf-tls-semistatic-dh. But it doesn't
work like that with PQ KEMs. 

KEMTLS introduces drastic changes to the handshake like implicit and
explicit trust and the option to send encrypted data to the server that has
not been fully authenticated yet. These concepts have not existed in TLS so
far. We are talking about TLS 1.4 here and a new security proof. It is no
longer TLS 1.3 with minor changes. Nothing wrong with that, but it is not a
trivial change at all.

The advantages of KEMTLS are 
- In KEMTLS the KEM is only used at the leaf. The rest of the cert chain
still uses Signatures. Thus, the signer does not need to support a PQ
signature algorithm but the verifier still needs to support a PQ signature
algorithm.
- KEMTLS saves 1-2KB of data compared to PQ Signatures (assuming Dilithium,
Falcon) which is an improvement, but based on experiments so far, it would
not have significant impact on a real-world handshake. It may impact
constrained mediums with high loss probability, but it won't be noticeable
for the rest of the handshakes. 
- The PQ KEM may have better side-channel resistance than the PQ signature
scheme.
- KEMTLS may be slightly faster if we are assuming Falcon, but not for
Dilithium. 

Rgs,
Panos

-----Original Message-----
From: Spasm <[email-masked]> On Behalf Of Mike Ounsworth
Sent: Thursday, January 28, 2021 4:59 PM
To: LAMPS <[email-masked]>
Cc: Douglas Stebila <[email-masked]>
Subject: [lamps] KEM-only certificates (KEMTLS)

I did not spend time on this during my talk today because I didn't want to
distract from the Composite topic, but I want to draw attention to my "Bonus
topic" slide about KEM certificates. I don't know if anyone else is
following the KEMTLS discussions (references below), but that would require
PKIs to issue large amounts of Key Establishment Mechanism (KEM; aka
keyUsage: keyEncipherment) TLS certificates. If TLS WG decides to adopt the
KEMTLS draft, then LAMPS probably needs to take a look at PKIX to make sure
we can handle enrollment, update, revocation for clients that don't have
signing keys. I took a (very) quick pass over CMP, Lightweight CMP, EST
(both simple and full-CMC) and attempted to summarize findings in my "bonus
topics" slides.

1: My slides from today:
https://datatracker.ietf.org/meeting/interim-2021-lamps-01/materials/slides-
interim-2021-lamps-01-sessa-position-presentation-by-mike-ounsworth-00.pdf
2: "Post-quantum TLS without handshake signatures", Schwabe, Stebila,
Wiggers, https://eprint.iacr.org/2020/534
3: "KEMTLS: Post-quantum TLS without signatures", Celi, Wiggers,
https://blog.cloudflare.com/kemtls-post-quantum-tls-without-signatures/

---
Mike Ounsworth

_______________________________________________
Spasm mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/spasm