Subject: [lamps] Proposed charter text for hash-based signatures in X.509 PKI (draft-vangeest-x509-hash-sigs)

From: Daniel Van Geest <[email-masked]>
Date: Thu, 14 Feb 2019 19:17:35 +0000

Last meeting I presented draft-vangeest-x509-hash-sigs to Secdispatch and LAMPS. It was decided the draft would be sent to LAMPS for potential inclusion during the recharter. Below I’ve included a draft of potential recharter text for the WG’s consideration. I can present the draft again in Prague if that’s desired.

X. Specify the use of hash-based signatures in X.509 Public Key
Infrastructure. Hash-based signatures use small private and public keys,
and they have low computational cost.  They are secure even if a
large-scale quantum computer is invented.  The low computational cost
for signature verification makes hash-based signatures attractive in
Internet of Things (IoT) environments.  The use of hash-based signatures
provides quantum resistant authentication in multi-party IoT ecosystems
where publicly trusted code signing certificates are needed.

Thanks,
Daniel

---

From: Jim Schaad <[email-masked]>
Date: Thu, 14 Feb 2019 11:55:48 -0800

What do you think that is needed to be specified beyond what is currently in draft-ietf-lamps-cms-hash-sig?  That document contains the pk-HSS-LMS-HashSig structure which describes how to place the public key into a Subject Public Key structure.  

Jim

From: Spasm <[email-masked]> On Behalf Of Daniel Van Geest
Sent: Thursday, February 14, 2019 11:18 AM
To: [email-masked]
Subject: [lamps] Proposed charter text for hash-based signatures in X.509 PKI (draft-vangeest-x509-hash-sigs)

Thanks,

Daniel

---

From: Daniel Van Geest <[email-masked]>
Date: Thu, 14 Feb 2019 20:52:28 +0000

Jim,

We have seen interest in defining similar OIDs for XMSS and XMSS^MT, which is not covered in draft-ietf-lamps-cms-hash-sig.

For HSS/LMS, at the time the x509-hash-sigs draft was written, the cms-hash-sig draft didn’t define OIDs for signature algorithms (it was specified that only SHA-256 would be used with CMS). Since the CMS draft now defines the signature algorithm OIDs we’ll have to re-evaluate the HSS/LMS sections.  When written, this draft referred to the CMS one for some definitions and added other new ones.

Now that the CMS draft defines all the OIDs, you’re right, this draft might not need to mention HSS/LMS at all.  Or should there at least be some text in there along the lines of “HSS/LMS OIDs are defined in [cms-hash-sigs], BTW you can also use those in X.509”?  Should there also be some small differentiating text indicating that in X.509 the HSS/LMS signature octet string is encoded as a BIT STRING?  cms-hash-sigs says “The signature values is a large OCTET STRING.”, which is accurate for CMS but for X.509 the encoding of the signature octets will be a BIT STRING.

Thanks,
Daniel

On 2019-02-14, 2:56 PM, "Jim Schaad" <[email-masked]<mailto:[email-masked]>> wrote:

Jim

Thanks,
Daniel

---

From: Jim Schaad <[email-masked]>
Date: Thu, 14 Feb 2019 15:06:01 -0800

Ok – so the first change is going to be say which hash-based signature algorithms you are dealing with, since it is not all of them.

As I noted with Russ, there is no guarantee that there is a small private key.  If you use a method of deterministic derivation from a seed, then it an be.  If you use a good external random number generator then the private key is proportional to the number of nodes in the tree.

Jim

From: Daniel Van Geest <[email-masked]> 
Sent: Thursday, February 14, 2019 12:52 PM
To: Jim Schaad <[email-masked]>; [email-masked]
Subject: Re: [lamps] Proposed charter text for hash-based signatures in X.509 PKI (draft-vangeest-x509-hash-sigs)

Jim,

Now that the CMS draft defines all the OIDs, you’re right, this draft might not need to mention HSS/LMS at all.  Or should there at least be some text in there along the lines of “HSS/LMS OIDs are defined in [cms-hash-sigs], BTW you can also use those in X.509”?  Should there also be some small differentiating text indicating that in X.509 the HSS/LMS signature octet string is encoded as a BIT STRING?  cms-hash-sigs says “The signature values is a large OCTET STRING.”, which is accurate for CMS but for X.509 the encoding of the signature octets will be a 
BIT STRING.
 
[JLS] This is just something that is poorly stated in the current document and is not something that needs to be changed.  It would be more accurate to say that “The signature value is a large byte string.” (or octet string) without using the ASN.1 type.  It is then just a string of bytes that is wrapped into some ASN.1 type.
 
Jim

Thanks,

Daniel

On 2019-02-14, 2:56 PM, "Jim Schaad" <[email-masked] <mailto:[email-masked]> > wrote:

Jim

From: Spasm <[email-masked] <mailto:[email-masked]> > On Behalf Of Daniel Van Geest
Sent: Thursday, February 14, 2019 11:18 AM
To: [email-masked] <mailto:[email-masked]> 
Subject: [lamps] Proposed charter text for hash-based signatures in X.509 PKI (draft-vangeest-x509-hash-sigs)

Thanks,

Daniel

---

From: "Scott Fluhrer (sfluhrer)" <[email-masked]>
Date: Fri, 15 Feb 2019 12:24:05 +0000

From: Spasm <[email-masked]> On Behalf Of Jim Schaad
Sent: Thursday, February 14, 2019 6:06 PM
To: 'Daniel Van Geest' <[email-masked]>; [email-masked]
Subject: Re: [lamps] Proposed charter text for hash-based signatures in X.509 PKI (draft-vangeest-x509-hash-sigs)

I believe that just saying HSS (or XMSS or XMSS^MT) would be sufficient; the public keys for all three include a parameter set descriptor, which declares the hash function to be used (and other parameters, such as the tree depth).

Well, yes, there is quite a range of possible time/memory trade-offs available when storing the private key; if you need to, the private key can be expressed in quite a small amount of space (albeit at the expense of making the signature generation operation expensive).

Jim

From: Daniel Van Geest <[email-masked]<mailto:[email-masked]>>
Sent: Thursday, February 14, 2019 12:52 PM
To: Jim Schaad <[email-masked]<mailto:[email-masked]>>; [email-masked]<mailto:[email-masked]>
Subject: Re: [lamps] Proposed charter text for hash-based signatures in X.509 PKI (draft-vangeest-x509-hash-sigs)

Jim,

BIT STRING.

Jim

Thanks,
Daniel

Jim

From: Spasm <[email-masked]<mailto:[email-masked]>> On Behalf Of Daniel Van Geest
Sent: Thursday, February 14, 2019 11:18 AM
To: [email-masked]<mailto:[email-masked]>
Subject: [lamps] Proposed charter text for hash-based signatures in X.509 PKI (draft-vangeest-x509-hash-sigs)

Thanks,
Daniel

---

From: Jim Schaad <[email-masked]>
Date: Fri, 15 Feb 2019 07:32:15 -0800

The first point referred to putting which algorithms in your proposed charter text.

From: Scott Fluhrer (sfluhrer) <[email-masked]> 
Sent: Friday, February 15, 2019 4:24 AM
To: Jim Schaad <[email-masked]>; 'Daniel Van Geest' <[email-masked]>; [email-masked]
Subject: RE: [lamps] Proposed charter text for hash-based signatures in X.509 PKI (draft-vangeest-x509-hash-sigs)

From: Spasm <[email-masked] <mailto:[email-masked]> > On Behalf Of Jim Schaad
Sent: Thursday, February 14, 2019 6:06 PM
To: 'Daniel Van Geest' <[email-masked] <mailto:[email-masked]> >; [email-masked] <mailto:[email-masked]> 
Subject: Re: [lamps] Proposed charter text for hash-based signatures in X.509 PKI (draft-vangeest-x509-hash-sigs)

 

Jim

From: Daniel Van Geest <[email-masked] <mailto:[email-masked]> > 
Sent: Thursday, February 14, 2019 12:52 PM
To: Jim Schaad <[email-masked] <mailto:[email-masked]> >; [email-masked] <mailto:[email-masked]> 
Subject: Re: [lamps] Proposed charter text for hash-based signatures in X.509 PKI (draft-vangeest-x509-hash-sigs)

Jim,

 
 
Jim

Thanks,

Daniel

Jim

Thanks,

Daniel

---

From: Daniel Van Geest <[email-masked]>
Date: Fri, 15 Feb 2019 22:41:51 +0000

X. Specify the use of the HSS, XMSS and XMSS^MT hash-based signature
algorithms in X.509 Public Key Infrastructure. Hash-based signatures use
small public keys, and they have low computational verification cost.
Private key size can be quite small, though there is a wide range of
time/memory tradeoffs between private key size, private key loading time
and memory, and signature generation.  They are secure even if a
large-scale quantum computer is invented.  The low computational cost
for signature verification makes hash-based signatures attractive in
Internet of Things (IoT) environments.  The use of hash-based signatures
provides quantum resistant authentication in multi-party IoT ecosystems
where publicly trusted code signing certificates are needed.

On 2019-02-15, 10:32 AM, "Jim Schaad" <[email-masked]<mailto:[email-masked]>> wrote:

From: Spasm <[email-masked]<mailto:[email-masked]>> On Behalf Of Jim Schaad
Sent: Thursday, February 14, 2019 6:06 PM
To: 'Daniel Van Geest' <[email-masked]<mailto:[email-masked]>>; [email-masked]<mailto:[email-masked]>
Subject: Re: [lamps] Proposed charter text for hash-based signatures in X.509 PKI (draft-vangeest-x509-hash-sigs)

Jim

Jim,

BIT STRING.

Jim

Thanks,
Daniel

Jim

Thanks,
Daniel

---

From: Daniel Van Geest <[email-masked]>
Date: Fri, 15 Feb 2019 22:42:05 +0000

Scott,

On 2019-02-15, 7:24 AM, "Scott Fluhrer (sfluhrer)" <[email-masked]<mailto:[email-masked]>> wrote:

I agree with the first part of your statement, and will update the draft charter text to reflect that.

For the second part, I assume the parameter set you’re talking about is the one encoded in the HSS public key itself (within the lms_public_key of the hss_public_key of mcgrew-hash-sigs), since cms-hash-sigs specifies that params are absent in the ANS.1 encoding of the public key.  The hss_public_key only encodes the parameters of the root LMS key, and since the signature encodes the parameters for the LMS public key at each level, there’s nothing in mcgrew-hash-sigs which precludes the different levels of the HSS signature from having different parameters than the root (including different hash functions, if new hash functions were added to HSS in the future).  While I don’t think this needs to affect charter text, should the draft itself (and cms-hash-sigs) have any considerations to regarding this potential.  Or would new parameter extensions to HSS need to specify whether or not hash functions can be mixed in an HSS tree, and the implications of doing so?

Jim

Jim,

BIT STRING.

Jim

Thanks,
Daniel

Jim

Thanks,
Daniel

---

From: Daniel Van Geest <[email-masked]>
Date: Fri, 15 Feb 2019 22:45:39 +0000

Sorry, this one got sent prematurely. The text below is the updated proposed charter text based on Jim’s comments. In addition to mentioning the specific algorithms, I added text indicating that there are time/memory tradeoffs for private keys, although I’m not sure how appropriate that is for charter text since the draft wasn’t planning on discussing those tradeoffs.

Thanks,
Daniel

Jim

Jim,

BIT STRING.

Jim

Thanks,
Daniel

Jim

Thanks,
Daniel

---

From: Russ Housley <[email-masked]>
Date: Mon, 18 Feb 2019 12:52:38 -0500

> Well, yes, there is quite a range of possible time/memory trade-offs available when storing the private key; if you need to, the private key can be expressed in quite a small amount of space (albei…

For draft-ietf-lamps-cms-hash-sig, does this capture your point?

   ... The HSS/LMS private key can be very
   small when the signer is willing to perform additional computation at
   signing time; alternatively, the private key can consume additional
   memory and provide a faster signing time.

Russ

---

From: Jim Schaad <[email-masked]>
Date: Mon, 18 Feb 2019 10:12:55 -0800

Yes that would capture my issue.  I keep wondering if it is good text for a
charter, but that is a completely different question and one I don't really
care about.

Jim

From: Russ Housley <[email-masked]> 
Sent: Monday, February 18, 2019 9:53 AM
To: Scott Fluhrer <[email-masked]>; Jim Schaad <[email-masked]>
Cc: [email-masked]
Subject: Re: [lamps] Proposed charter text for hash-based signatures in
X.509 PKI (draft-vangeest-x509-hash-sigs)

Jim and Scott:

As I noted with Russ, there is no guarantee that there is a small private
key.  If you use a method of deterministic derivation from a seed, then it
an be.  If you use a good external random number generator then the private
key is proportional to the number of nodes in the tree.

Well, yes, there is quite a range of possible time/memory trade-offs
available when storing the private key; if you need to, the private key can
be expressed in quite a small amount of space (albeit at the expense of
making the signature generation operation expensive).

Russ

---

From: "Scott Fluhrer (sfluhrer)" <[email-masked]>
Date: Mon, 18 Feb 2019 18:48:13 +0000

That works for me...

From: Russ Housley <[email-masked]>
Sent: Monday, February 18, 2019 12:53 PM
To: Scott Fluhrer (sfluhrer) <[email-masked]>; Jim Schaad <[email-masked]>
Cc: [email-masked]
Subject: Re: [lamps] Proposed charter text for hash-based signatures in X.509 PKI (draft-vangeest-x509-hash-sigs)

Jim and Scott:

Russ