Subject: [lamps] Re-charter text for LAMPS to work on Post-Quantum, and PQ problem statement

From: Mike Ounsworth <[email-masked]>
Date: Sat, 24 Aug 2019 13:49:12 +0000

Hi LAMPS,

After the discussion at 105, I'm going to take a step back from my "composite crypto" draft and propose:

A) LAMPS re-charter so that post-quantum is guaranteed time on future agendas.

B) As a group, we define the post-quantum certificates problem that we're trying to solve, and examine the whole space of possible solutions.

---
A) Proposed re-charter text:

> Quantum computers and the emerging post-quantum cryptographic algorithms present a unique agility challenge in that legacy algorithms may become compromised before we have full trust in, or adoption of, the replacement algorithms. The prevailing opinion in the crypto community is to address this uncertainty by layering all crypto operations with legacy and post-quantum algorithms during the transition period. LAMPS is tasked with specifying appropriate mechanism(s) by which PKIX and relying protocols can leverage public keys from two or more algorithms in the same cryptographically-protected transaction. Proposed mechanisms should address combining new and conventional algorithms, backwards compatibility, and increased certificate size. Both negotiated and non-negotiated protocols need to be considered.

The first discussion question is: what is appropriate for LAMPS adoption here? If it doesn't get adopted by LAMPS, maybe we need a specific PQ WG? Maybe we should run a BoF session at 106?

---
B) Problem statement and solutions overview; I put up a draft here:

https://datatracker.ietf.org/doc/draft-pq-pkix-problem-statement/

Let the discussions begin!

- - -
Mike Ounsworth | Software Security Architect
Entrust Datacard

---

From: Stephen Farrell <[email-masked]>
Date: Sat, 24 Aug 2019 15:01:46 +0100

Sorry to be negative but...

> A) LAMPS re-charter so that post-quantum is guaranteed time on future agendas.

To me, that's close to the antithesis of what LAMPS
was setup to do.

If current PKI is going to be challenged by quantum
computers then IMO we ought re-think x.509-based PKI
and not just consider all that an issue to tackle via
algorithm agility and whatever other ad-hoc hacks we
stumble upon.

x.509 is >30 years old as a container technology for
public keys. Pretty much everyone hates it or just about
puts up with it. IMO we ought not continue to use x.509
across such a classic/post-quantum boundary - if we get
anywhere near wanting multiple keys bound to an identifier
(and have >1 of those used for a single key establishment)
then I can't see how the costs of re-using x.509 would
be worthwhile compared to the costs of ditching x.509.

Such a re-think is definitely not a limited additional
mechanism for PKIX or S/MIME.

S.

---

From: Mike Ounsworth <[email-masked]>
Date: Tue, 27 Aug 2019 19:28:19 +0000

Thanks for the feedback Stephen,

I see your point that such a re-think / replacement of X.509 is well outside the scope of LAMPS.

I believe that there are three categories of small modifications to existing X.509-based PKIs that will accomplish the goal (as outlined in my "Problem Statument" draft below)

The question I'm asking is which X.509 tweak solution(s) are worth pursuing? And how / where?

- - -
Mike Ounsworth | Office: +1 (613) 270-2873

-----Original Message-----
From: Stephen Farrell <[email-masked]> 
Sent: Saturday, August 24, 2019 7:02 AM
To: Mike Ounsworth <[email-masked]>; [email-masked]
Subject: [EXTERNAL]Re: [lamps] Re-charter text for LAMPS to work on Post-Quantum, and PQ problem statement

> A) LAMPS re-charter so that post-quantum is guaranteed time on future agendas.

To me, that's close to the antithesis of what LAMPS was setup to do.

If current PKI is going to be challenged by quantum computers then IMO we ought re-think x.509-based PKI and not just consider all that an issue to tackle via algorithm agility and whatever other ad-hoc hacks we stumble upon.

x.509 is >30 years old as a container technology for public keys. Pretty much everyone hates it or just about puts up with it. IMO we ought not continue to use x.509 across such a classic/post-quantum boundary - if we get anywhere near wanting multiple keys bound to an identifier (and have >1 of those used for a single key establishment) then I can't see how the costs of re-using x.509 would be worthwhile compared to the costs of ditching x.509.

Such a re-think is definitely not a limited additional mechanism for PKIX or S/MIME.

S.

---

From: Stephen Farrell <[email-masked]>
Date: Tue, 27 Aug 2019 21:37:52 +0100

Hiya,

On 27/08/2019 20:28, Mike Ounsworth wrote:
> I believe that there are three categories of small modifications to
> existing X.509-based PKIs that will accomplish the goal (as outlined
> in my "Problem Statument" draft below)
I agree we're espousing different approaches to thinking
about what to do with PKI in a possible PQ crypto world.

Even if the correct approach to authentication in a PQ world
were to tweak X.509 (which I don't accept, esp if alternatives
have not been explored) I would still argue that that's too
big a thing to be considered a "Limited additional mechanism"
as it involves entirely new cryptographic algorithms with
as-yet not well understood protocol and API impacts. It's
just kind of laughable to claim that's anything like a
reasonable use of the term limited.

This is a fine example of why we really ought not allow this
WG to become a zombie PKIX that ingests and regurgitates
anything even vaguely related to PKI. That didn't serve us
well when we did it before. At that point (maybe from 2004ish
on?) I was one of the regurgitators, so I fully understand
why this may seem attractive, but it's just a bad plan IMO
that's highly likely to lead to wasted effort and worse
interop.

Again, sorry to be so negative.

To be positive, I would support a non-WG forming BoF or
mailing list on the topic of "what to do about PKI in a
PQ world and when to start doing anything at all."

Cheers,
S.

---

From: Russ Housley <[email-masked]>
Date: Wed, 28 Aug 2019 14:36:34 -0400

Mike:

I think that you should take your draft to the SECDISPATCH mail list and see if they want to put you on their agenda or go straight to a BoF.

Russ

> On Aug 27, 2019, at 3:28 PM, Mike Ounsworth <[email-masked]> wrote:
> 
> _______________________________________________
> Spasm mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/spasm

---

From: "Salz, Rich" <[email-masked]>
Date: Wed, 28 Aug 2019 18:38:57 +0000

>    I think that you should take your draft to the SECDISPATCH mail list and see if they want to put you on their agenda or go straight to a BoF.
  
+1

---

From: Mike Ounsworth <[email-masked]>
Date: Thu, 29 Aug 2019 14:48:29 +0000

Thanks. We will bubble this over to SECDISPATCH. I appreciate the guidance!

- - -

-----Original Message-----
From: Salz, Rich <[email-masked]> 
Sent: Wednesday, August 28, 2019 2:39 PM
To: Russ Housley <[email-masked]>; Mike Ounsworth <[email-masked]>
Cc: [email-masked]; Stephen Farrell <[email-masked]>
Subject: Re: [lamps] [EXTERNAL]Re: Re-charter text for LAMPS to work on Post-Quantum, and PQ problem statement

+1