Subject: [lamps] Spencer Dawkins' No Objection on charter-ietf-lamps-02-00: (with COMMENT)

From: Spencer Dawkins <[email-masked]>
Date: Wed, 23 May 2018 11:13:48 -0700

Spencer Dawkins has entered the following ballot position for
charter-ietf-lamps-02-00: No Objection

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)

The document, along with other ballot positions, can be found here:
https://datatracker.ietf.org/doc/charter-ietf-lamps/

----------------------------------------------------------------------
COMMENT:
----------------------------------------------------------------------

I am, of course, curious about Warren's BLOCKing comment, but assuming that
conversation goes well ...

I had some editorial comments, of course.

The last sentence in this list item is borked, as Warren noted ...

3. Specify the use of short-lived X.509 certificates for which no
revocation information is made available by the Certification Authority.
Short-lived certificates have a lifespan that is shorter than the time
needed to detect, report, and distribute revocation information, as a
result revoking them pointless.

Perhaps something like

3. Specify the use of short-lived X.509 certificates for which no
revocation information is made available by the Certification Authority.
Short-lived certificates have a lifespan that is shorter than the time
needed to detect, report, and distribute revocation information. As a
result, revoking such short-lived certificates is unnecessary and would be
pointless.

I'm not sure that "near-term" is necessary in the first sentence of this list
item.

4. Specify the use of a pre-shared key (PSK) along with other key
management techniques with supported by the Cryptographic Message
Syntax (CMS) as a near-term mechanism to protect present day
communication from the future invention of a large-scale quantum
computer.

I found it confusing because "near-term" isn't "near-term from now", it's
"near-term after the invention of quantum computing destroys civilization. If
you want an adjective, perhaps something like "proactive" would be closer.

In this text,

5. Specify the use of hash-based signatures with the Cryptographic
 Message Syntax (CMS).  A hash-based signature uses small private and
 public keys, and it has low computational cost; however, the signature
 values are quite large.  For this reason they might not be used for
 signing X.509 certificates or S/MIME messages, but they are secure
 even if a large-scale quantum computer is invented.  These properties
 make hash-based signatures useful in some environments, such a the
 distribution of software updates.

I wasn't sure from this description whether quantum computing resistance was
the only "environment" where these are applicable. As a nit, s/such a/such as/.

---

From: Adam Roach <[email-masked]>
Date: Wed, 23 May 2018 14:35:54 -0500

On 5/23/18 1:13 PM, Spencer Dawkins wrote:
> "near-term after the invention of quantum computing destroys civilization.

My understanding is that the intention is "near-term from now." The idea 
is that LAMPS should develop something that you could use, say, next 
year to encrypt email you send so that, 15 years from now when someone 
finally builds a 4,000 qubit machine, they can't dig out your (then) 
14-year-old email and decrypt it.

/a

---

From: "Salz, Rich" <[email-masked]>
Date: Wed, 23 May 2018 19:40:34 +0000

Kenny Paterson gave a talk at a recent IETF where he said, basically, that the IETF should wait until NIST is done with their post-quantum evaluation/competition.  Are we sure we want to disagree with him?  Or is it just because digest-based signatures are well-understood that we're willing to do so.

---

From: "Salz, Rich" <[email-masked]>
Date: Wed, 23 May 2018 20:06:59 +0000

>    That is not quite what he said.  Kenny said that we should not adopt a post-quantum secure algorithm.  Kenny did not say we should not find ways to use pre-shared secrets to bolster the security of the techniques we are already using.
  
You are right, thanks for the correction.

---

From: Russ Housley <[email-masked]>
Date: Wed, 23 May 2018 16:01:13 -0400

> On May 23, 2018, at 3:40 PM, Salz, Rich <rsalz=[email-masked]> wrote:
> 

Rich:

Another example where we are mixing the pre-shared secret is draft-ietf-ipsecme-qr-ikev2.

Russ

---

From: Phillip Hallam-Baker <[email-masked]>
Date: Wed, 23 May 2018 16:16:37 -0400

I am not sure that that is possible.

Signature is easy, just pickle the data and signature in a hash-chain and
you are done.

Problem with confidentiality is it is break once and it fails. All that you
can do by adding technology to a public key encryption system is to provide
additional ways to decrypt. The only way to protect against quantum
cryptanalysis is to only use quantum resistant crypto. We can do that (e.g.
Kerberos) but it ain't easy.

Forward secrecy doesn't provide quantum resistance and it only works at the
message layer, I don't know how to apply forward secrecy to data at rest
(would love to hear suggestions),

What I do to provide protection is a multi-layer encryption stack with
crypto going on at the Transport, Transaction and Data layers. I can't use
forward secrecy above the transaction layer.

On Wed, May 23, 2018 at 3:35 PM, Adam Roach <[email-masked]> wrote:

> is that LAMPS should develop something that you could use, say, next year
> to encrypt email you send so that, 15 years from now when someone finally
> builds a 4,000 qubit machine, they can't dig out your (then) 14-year-old
> email and decrypt it.
>
> /a
>
>
> _______________________________________________
> Spasm mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/spasm
>

---

From: Spencer Dawkins at IETF <[email-masked]>
Date: Thu, 24 May 2018 07:51:58 -0500

Backing up slightly ... my ballot set off a pretty interesting discussion,
but I didn't want to lose sight of my point, which was

> 14-year-old email and decrypt it.

OK, that sounds like a plan, but it's not the way I understood the text,
and I note that the sentence makes more sense to me without "near-term",
resulting in

 "4. Specify the use of a pre-shared key (PSK) along with other key
management techniques with supported by the Cryptographic Message
Syntax (CMS) as a mechanism to protect present day
communication from the future invention of a large-scale quantum
computer."

which I would have read as saying what Adam said it means.

Do the right thing, of course ;-)

Spencer