Subject: [jose] Support PQC in JOSE

From: Antonio Sanso <[email-masked]>
Date: Mon, 1 Feb 2016 09:27:43 +0000

hi *,

I know that this might sounds a bit crazy but I think that is time to kind of think about Post Quantum Cryptography (and JOSE should not be left out).
But let me rewind a bit. 
 According to the last research (done from IBM et al) and NSA suggestions, having a quantum computer is “only” 8/15 years from now (maybe earlier)
Taking as example JWS it support RSA signature. A quantum computer will break computer will break totally this (thanks to Show algorithms).
Thinking about start to expand JWS specification to use some of the PQC is not so inimmaginable IMHO.
 For example having JWS supporting Hash based signatures would be a great move (always IMHO :)) for JOSE and JWS. 

WDYT?

antonio

P.S. a great post about Hash based signatures and Merkle tree is at https://www.imperialviolet.org/2013/07/18/hashsig.html

---

From: Antonio Sanso <[email-masked]>
Date: Mon, 1 Feb 2016 09:50:01 +0000

ops it look like I kind of fat fingered , meant 

A quantum computer will break totally this (thanks to Shor's algorithm).

On Feb 1, 2016, at 10:27 AM, Antonio Sanso <[email-masked]> wrote:

> _______________________________________________
> jose mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/jose

---

From: Anders Rundgren <[email-masked]>
Date: Mon, 1 Feb 2016 16:24:12 +0100

>   For example having JWS supporting Hash based signatures would be a great move (always IMHO :)) for JOSE and JWS.

I'm a complete n00b when it comes to PQC but if the scheme you suggested
https://en.wikipedia.org/wiki/Merkle_signature_scheme
is considered useful, it shouldn't be particularly difficult to implement.

If I interpret this correctly, you would have to regenerate signature keys
quite frequently which requires a specific infrastructure to work.  OTOH,
short-lived keys are actually quite handy in more traditional systems as well
so this is definitely worth investigating.

Clear text signature schemes like JCS should be ideally suited for PQC since
signature data seems to become the major part of a signed object.

Anders

---

From: Stephen Farrell <[email-masked]>
Date: Mon, 1 Feb 2016 15:37:01 +0000

The IRTF's CFRG [1] are at the beginning of considering PQC
so I'd say discussion would be much better off there and not
(yet) in the IETF. IMO none of the PQC schemes are ready for
prime-time right now, so CFRG is a much better venue.

Cheers,
S.

[1] https://irtf.org/cfrg

---

From: Antonio Sanso <[email-masked]>
Date: Mon, 1 Feb 2016 16:19:53 +0000

thanks. It sounds reasonable.

I will subscriber to CFRG mailing list so .

regards

antonio