Internet Engineering Task Force 101, 23 Mar 2018

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: IETF101-LAMPS-20180323-1150

Description

LAMPS meeting session at IETF101
2018/03/23 1150

https://datatracker.ietf.org/meeting/101/proceedings/

A

Okay, bye, my watch is time to begin, can I get someone to close the doors just to cut down on the noise, remind people that we have remote participants, and so please use the microphone.

A

This is the note well, it was updated this for the meeting this week, yet it's Friday you've probably seen it a whole bunch of times, but still we must follow it. So please pay attention.

A

At the SEC Dispatch meeting earlier this week, two giraffes were discussed and the recommendation of the SEC dispatch working group was to send them here. So the first one has to do with short live certificates and the second one has to do with using hash-based signatures in the cryptographic message syntax.

A

So these both are clearly out of charter. So it's interesting that we have a new way of getting suggestions to have that impose a recharter, so I'm not going to use anything during this meeting to start discussing charter text, but in the next week, or so we'll start a discussion to tackle that action.

A

So this is the agenda. It's been out for quite a while. If there's any bash, please do so now.

A

Okay, so the first two items: are you bashing Alexi now, okay,.

B

A

Just wanted to alright, so the first two items have to do with including internationalized email addresses in certificates.

A

One is an update, 250 280, which essentially updates some of the internationalization things, and the second one is defines an other name to carry the AI. Those are now both. Finally, in the RFC editors cube, Alexius on to say, correction.

B

The second one is not, oh, you need to sound it. It's still no.

A

I thought you had like the.

B

Data track the status it.

C

D

Say all right: okay,.

A

In a minute it will be.

B

Well, I could but some people might think it's okay. Thank you.

A

I could swear, I saw email that it was, but okay.

A

I believe that the area director believes all of the open issues have been sorted. That's what that's for sure that you know I saw anyway. The next one is two documents that have been sent to the is G: they together define sym 4.0, and we have some issues and, and that were raised and Jim is gonna address. Those.

E

Okay, so I've been due to work load sitting on a couple of comments from the ad director that, when I.

F

E

Sure the ad that basically when I looked at them I said oh I'm, not really too sure what the right answer for then this isn't just an easy edit. So next slide so the first one is, he requested a simplification of the language. um This is basically the traditional language that Russ wrote way way back when and everybody's just cut and pasted it. Since then, and as Tucker pointed out, it is redundant as all get-out.

E

So are there any issues with actually just cleaning the redundancies up that anyone has all right? Are you basically what I'm.

A

Mostly red and green.

E

A

E

What I'm looking at is anything this green goes away and.

A

E

Green black stays right backstage. Okay, anything this green goes away. That means that black and red stay.

A

That is not okay, so.

G

As one of the people watched the.

E

Way I highlighted it was a red actually was important.

E

G

Sean Turner, so is one of the guys who probably copied this forward. Let's just fix it and be done with it. uh I'm.

E

Assuming that there is absolutely zero interest in making any sort of errata James good.

H

E

E

Okay next slide.

E

This one's a little bit more complicated part of that language basically said: if things aren't right, what do you do? It just says: don't do it so basically, you've got a whole slew of things that might actually occur.

E

And be wrong, but we don't give any guidance um what you should be doing. We just write so far. It basically said no one does it. We can ignore that problem. So when any of those things happens, we've got a couple of different things we can do and they may differ based upon which violation. It is one by one thing would be to say: just ignore the attribute entirely. One would be to come up with a canonicalized method of choosing which one you want to use and one would be kind of a mixture of.

E

If it's something you care about, then you need to make an error out of it. Otherwise you can just let it slide so choosing which one is first and using that one is interesting, because is they sit? Basically, the thing could occur multiple times and with each occurrence there could be multiple values so choosing which ones first should be like kind of saying: let's collect all them together, sort them and by lexical lexical order and then take the first one.

A

This is rustling, given that this has been in that's. Why I'm one s/mime to s/mime three? Yes, my three 1s, why I'm three two and we have not had any interoperability over this? The sender's are following the must: never that or the recipients.

E

Weren't noticing it right.

A

So what I would propose is that we put a statement in that if any of those musts are violated, the recipient should ignore it not must but should, and then that will at least make things okay.

E

Is your you had, which is, would that be happiness? Ekor.

I

So I think for the last two: that's fine for the first I mean the first two are the same right right, so we, but it seems like the seems like it should be, an error. If it's signed or two that it's not signed, don't you think you should be ignored. Do you think so? Yeah.

I

Okay, mr. worker position, not what I would have done I mean.

C

This is information about what my kids Stephan Stephan Saunders on 3xa security, so I mean as mine capabilities advertisement of my capability correct. So if I stated something that violates not being once I mean I still stated it sorry, there's no harm in assuming that I can deliver on that statement. So I, don't know why you should say should ignore.

C

A

The real issue is: if, if you provide two statements of your capabilities that are not the same, what do you do? Add them up the.

E

Other is there anything, there is more.

H

E

This one attribute that has the problem correct.

B

There are other attributes.

E

That have the same problem, for example, sash or signing time, I mean.

A

Could coach there.

C

Could there I mean, should there be conflict? One says something that is completely incompatible with another I. Can.

J

C

Then then there is a bigger problem. Sorry.

K

Paul Hoffman, who actually only came here for CAA but for history value? Well, the other problem we had was signed and the signature has to be valid. So when we came up well, but but this was one of the reasons why we sort of left it at just be ignored, is if that part, if that part. Thus, if the signature is broken on that, we don't want to say, therefore everything goes to hell. We just want to say: okay, ignore it. At least that was that was the thought. Ten or fifteen years ago, I mean.

E

Right is, this is a deliberate thing on the point of the sender, this is not an attempt in the middle I.

I

Mean so no I mean, maybe um so um you know consider so consider the following situation: we have a pair of client and server, so I sent a receiver where they've been using RSA 1024 and they both grow. The capability to do occur to 500 and the UM and the sender sends you a message with SMI capabilities is that is a signed message and si capabilities that are, but they say, ah here's you 509 and no I think about that order.

I

The signatures, but the bottom line, is that they, the middle the guy in the middle strips out the signature, thus causing you to receive the message, but in northern Kate and northern not limited capability, that's downgrading you so again, I gotta think about the order of like which pieces are protected by with other pieces, but like the fact that, like that, the fact, the fact that this is sort of a bundle of things you know it's not clear to me exactly like you know.

I

It's not clear to me that, like that that the treating is not clear to me that treating you know non-zionist as ignore is equivalent to like not having any attacks right well,.

A

By doing that, he's also just a signature off the content. It's the same signature yeah.

L

I

He's probably joking.

L

I

Just did I say I'm, not sure I have a real thing, I'm just sort of saying, like it's not obvious to me that it did it I mean. Certainly, is it obvious to me that it did ignoring, under these circumstances, academies or career implications, but again like this? Is it this is working? Were decisions a lot like saying you shouldn't? Do it um um I mean I'm, saying I personally, like that I'm surprised? That's why feeling is a good idea, but like about like?

I

Is there a director or like this is like you guys need to do them like I'll step on the way.

F

John Levine I don't purport to be an expert in this area, but I can say in every area every other place where we've tried to guess how people screwed up and recover from it. It does not turned out well we're telling people out it we're telling people how to interoperate so like if you want it. If you want it to work, do this and if you don't, you know, and if you do something else, you're taking your chances so I think ignore is probably the simplest advice.

F

If you go, if you you know, the alternative is to continue not to give any advice because legs right, like cuz you're, if you don't do it, then you're not interoperating. So you know you're outside the bounds of what we're talking with what we're describing I.

D

F

E

To decide whether ignore is ignore and and go ahead and accept, what's there in some form or pretend the attribute didn't exist, that.

F

Sounds like we're getting into local policy.

I

Well, I was gonna, propose, reject the message with an error, and so it's only we came to other advice, Indian or is reject the message of the errors that malformed or reject that particular I mean you know, I'm gonna, say draft Thompson, pastels, wrong here.

I

J

Mobile options I've already heard that also.

I

The table are like is it um you know if people comply, I mean I, guess I would claim people comply with this now then then Japanese harmless and will agree, heat-resistant, better act.

A

Or let's say we went down that path? Would you be happy with a should reject or must reject.

M

A

This does anyone in the room want to speak against, should reject.

A

Okay, then we got.

H

K

And I would like to speak against, should reject just because a history that hasn't been being rejected till now I certainly would assume that you know the folks who are doing s. Mine, capable clients will do this and all of a sudden, a message that worked yesterday will not work today because it should reject is going to be. You know that means default project and I. Don't think we have a good reason why?

K

So somebody especially where, if the signature was getting lunged in you know by some gateway, especially on the sender side, the recipient didn't really care about the signature and such like that has just always been sort of going through I. Don't.

A

Think that's right, Paul! Well, then I think what's happening is all the must and must not imposed on the sender are being followed. This is never happening. Oh yeah, okay,.

K

A

K

By the recipient.

A

Behavior, when they're not followed and that's what we're trying to fix.

K

Okay, I can believe that yeah and at which point then, yes, it would be logical to say that I was always thinking on recipient side. Okay, I can leave that.

E

Okay, so I think that's at this point, that's clear what we do is doing do next, all right back. One.

E

There's some language about weak cryptography, which is left over basically from the days of 40 bit 40 bit stuff, and since we've now basically moved Triple DES into the world of we, we think that that's too weak to be used language saying that we cryptography basically gives you no benefit, is a bit more sketchy than it used to be so. Should we clean this language up or can we or do we just leave the language, as is um the first sentence, is basically what's in the document.

I

You might claim, as a present as just false.

I

So I mean I, think I think I need everybody saying that is like the morning was that like then the loss occurred like I. Think a lot of things you could say but I mean I mean three days is like as far as we know very nearly as secure as aes-128, so uh-huh.

N

Yeah I mean Phil Hardberger. The issue is, is weak, being used as a term weak Rafi being used as a term of art here or just descriptive term, because if a es is strong well, it's not weak, so I mean, but you could just fix it by saying instead of having offers replace it with small lowercase may offer. So it says using sweet cryptography s. My may offer little actual security over sending plaintext and then we're done.

E

Racking through my brain I believe is just it is not a statement of art. It is just a descriptive statement at the point.

I

No fortunately, yeah.

E

I bet there's something: I have to actually.

O

G

Assume some of the security considerations, so the section at t7 seats is about choosing the cryptography algorithms that he's honored told the Chinese are considered to be weak.

E

As if that would be a term of art, yes,.

I

Use them like please all right.

L

I

That I actually noticed this I see. It also says algorithms using 112 bit keys, not her topic, keys or less so apparently, apparently, r2 is not. We cryptography so like this is like super weak make a week. I don't know strongly week exactly yeah.

E

I

I think I think it's fine to call it week. I'm like Jessica like a week, I mean do we have I mean and I try to remember is like. Are she to in DES, like even in this document anymore? At all? Are the.

E

Only for historic purposes, yeah, but.

I

I mean I get. My point is this document. This is a term of week in this document need to cover them as well. If it does, then, when you revise your 72 so with like so that so it covers them and then and then I think maybe I mean I got my items. There's a new texture. I mean you basically just say like you know, like I mean I guess only we can do wants. This is like weather summary. Is it what it says? Is you.

A

May have things in your folders or not rip to do.

E

Where this text is, if I remember right, is it free where this Texas first use is, you may need to send to somebody who's got an old client, and that may not be a good idea. I see both.

A

E

I mean it is, if the historic one you kind of have to support it. If you want to read roll mail, so, okay.

P

This core goods.

D

This is Daniel con Gilmore, so I mean well I, my inner patent degrees with everyone. This text is false, like it seems to me, like the security considerations goal here, should be to give concrete and and and opinionated guidance on what people should be doing and I don't I. Don't actually think it's a that big of a deal to have an overstatement here, so I would say, leave it alone,.

A

Well, 112 or less I think it should be fixed.

E

Week is not necessary: typing East, Side's I.

H

I

Think our she should say things we know to be untrue, I mean I mean no. You gotta true, like what we'll say. All things are untrue that we don't well. We should not knowingly put things in our season. You know to be untrue. What cuz, Mike both of us closely violated I, mean I, think I.

I

Think those suggestion we find- or you know um you know- does not meet modern security standards and may offer the little security over plaintext things like, like a number of things you find here, I just think I, just think it's like Ashley before ok.

E

I think I know roughly the sort of thing it needs to say so. I can probably manage or rewrite at this point in time on next slide.

E

Pk cs6 certificates- yes, they are that they are still in the spec. Yes, it says you're supposed to be able to accept messages that have them I. Don't know why, although my code does do so and then promptly ignores them, is there any problems with just making as an absolute must not.

A

Does anyone support PK, cs6 anymore has.

E

Anyone ever supported.

A

Seeing no one trying to defend it, I think we go with mus, not okay,.

E

The second one is, is I, basically need a historical Treach, because my mind has failed. Oh yeah.

I

Q

So the question what this is from John Lennon, he wants to know if it's in the ASN dot one it is in the.

E

A sent that one.

I

So so the I push back on this, my which say that the.

I

So the type this tested I being a trusted agent right um so right so I mean the problem is, if you have, let's let us say you have situation where you have. You determine a trust agent by doing pika verification from some for some right and so like I, don't know the agent is agents got the name, timestamp co-signed calm and you do to do PR resolution now.

I

um So you were see the message and- and it's got a signing time some time like role to be four in the past and you, and so you evaluate the certificate chain on the basis of that time, which is from the trusted agent. But in the meantime this is been revoked, and so, but that means you can't trust that that's like the tare tine is that the sign ten is in there. So I shoulder say that how this text provides.

I

The security is supposed to provide because like because you need to know the time of day when the thing was generated in order to in order to evaluate the certificate chain and the internal distrusted agent in order to start right.

E

No I completely agree with you, I mean it's that the text has written, makes absolutely no sense. What I was trying to dig out of my brain and have been unable to do so is what sort of trusted agent we thought we were talking about in this situation. Oh.

A

No, that I recall was the timestamp authorities that.

E

Was my gasps yeah I could remember for sure, in which case the way this sentence is written makes no still.

J

E

That point is, you may use a counter signature to establish behind establish to verify this is before vote. Yes, Stefan.

C

I, just wonder if it's a must not on the sender or receiver side for both hi.

E

This is Jane validation, ssl receiver. This is Rasul.

C

Firing counter one I must reject.

E

The text that I cut it before this basically said you should use the current type when doing validation. Oh sorry, I.

C

E

Is this is the the qualifier on the shoot yeah.

C

I was actually sorry, I was actually asking the pika since 600 are.

E

The pkcs six, it says, I.

A

Was liberal, slow, that's a different certificate format yeah. It.

E

Basically says you should accept it, but you don't have to process it. Yeah.

C

Because it's it's it's a clear I must not on the sender side, but is it the mas not on the receiving side? Now I should hope, not in case somebody has one stored in a folder exactly so it would be even compatible change, yeah records, okay,.

E

So I think it may still be worthwhile to talk about using the counters using the time from a counter signature to validate, but I think. Obviously this this text as written is totally bogus. So, okay I can do that. I. Think that's the end. It's.

A

Your last slide: okay,.

E

I said so, I should have changes to occur to prove by the end of next week and once that hat once he says, those are fine out. We publish and send to the list so that the list can actually look at everything, I've changed and then we can go to iesg. Last call.

A

Okay, so the next agenda topic is regarding CCA simplification and I. Think Jacobs going to present remotely is.

H

A

Is that what I said.

A

R

I meant to say yes, everyone can hear me all right. Yes,.

B

R

So in case you haven't heard, CAA is a great success. It's mandatory for CAS and the web PPI now as I've last September um along the way we proposed and approved in this working group, an errata m-- to how CAA records are discovered, in particular, how they handle see names and do names so as implemented in the web PKI when the cname chain, you just evaluated it straight through, and you don't go into each post name into the CAA chain and do additional trephining on that.

R

So our main goal with the parent draft is to bring in that or atom and document what's implemented in the word ppi. The current draft also has a deployment considerations section which describes some of the practical failure modes we've seen from some dns servers in the wild.

R

So that's you know pretty far along. It's been adopted as a working group draft. So the next step for me is to upload the next revision of it as a document.

R

There are also two open pieces of feedback for Yvonne all Trustwave as a fix to the a B and F grammar of CAA records, which is ambiguous in 6844. We also have a request for a section describing what change in Y, which I'll add in the next raft, and that's all of that.

A

A

People are coming to the mic Jacob.

R

O

Tim Holly week, there's also another errata that Corey has opened about the issue of when there's and when there's a CAA tag and there's no issue record in that everybody on the list is clear. What the correct interpretation is. The a strict reading of the existing document, though, does not actually say that so that's another one that I think you're going to want to fix.

R

K

Hoffman so I've been touristing on some of the various cab form lists where this sort of blew up. You know some months ago, I, don't think we're that close to done necessarily until we see the working group document simply because some of those things that you've documented in the you know strangeness as we found out they're the people who reported them when they said we did something really meant it as we did it in good faith. So I think that there's gonna need to be more text in the body.

K

That says explicitly don't do this for, for a fairly large number of this is at least four or five, even though those of us who are used to reading protocol documents, you know thought that I was surprised by the the number of different implementation errors that were there and again done in good faith, not out of laziness. These aren't, like you, know, IOT OEMs.

K

These are CAS who really care about, become you know, being a CA next year and so I I think it would be really good to lengthen the document a little bit with, even though it seems like, if it says, do X. If someone do the inverse of ax, you know, for whatever reason, I think it's reasonable to also say must not do inverse of X as well. Based on the implementation experience.

R

That's back I off the top of my head and not sure of the exact examples you think you know, but if you could send some examples to the list, that would be super hot ball. Thank you.

S

Tony Finch I have had a look at the current draft and I noticed in the deployment consideration section. It talks about dropped, queer, dropped, answers and refused answers. One of the problems that we came we encountered when CAA was first it was introduced, was the problems with issuing certificates for private domain names.

S

My understanding is that CAS have altered their code to make it more lenient in the kind of problem cases that we encountered, but I wondered if that's something that should be described in more detail in the draft and the other problem we encountered was to do with cname handling, but it looks like you're already addressing that. So that's good.

R

Yeah, it's a good question. You know, I think. The experience that let's encrypt has had is that there are kind of two common mechanisms for having a private sub-branch of your main public domain space, and one of them works. Fine, where you you publicly and show a return sign, X domain and the other doesn't, which is I, believe the one where you delegate to a non-responsive name, server for subdomain trees, but that definitely met some discussion of employment considerations.

A

Any other questions: okay, we look forward to the I'm sorry yeah.

Q

This this is from the jabber room. It's Cory banal. Has there been any discussion on changing the should for querying the authoritative nameservers to a mosque in section 16? Excuse me, sir section 6.3 not as far as I've seen.

R

So that's something we should discuss. I.

A

Guess if he wants that change, bring it to the lists.

A

Okay, yeah I'm, not seeing anything else, thanks Jacob, that's all.

A

The next topic is shake 4p, kicks and then CMS.

J

A

Not in the room.

J

So um last time we receive our comments from the group and to make changes um and to remove the DSA, and we also edit a lot more details to it.

J

So we do move DSA, we updated the OID, we added the mass generation function. Are we updated the OSAP SS section?

J

We added the puppet Kyo, a DS, updated in introduction and on their sections, updated titles and some other things so.

J

Here's our d6o IDs again our number 17 and 18, and the the function o IDs has the parameter is called shake-up woodlands, which must be accommodated with the oids whenever one of these function is used and for this documents, we'd acquired a boot lengths to be greater than or equal 32 or 64 advice.

J

And here's we copied the OID for the master wave function, number 1 from the pkcs number 1. It's not right. Now number is 8 arm to use a shake as the mass generation function, the the oh I D must accommodate must have the parameter, which is a hash away them value, and so in this case you have to use either one of those two IDs we mentioned above.

J

So here we copied again from the IFC 4055 in this document we required the D either. One of those two functions to be used. It has algorithm and the shake a boot lens which is accommodating the shape or IDs must be present and either equal to 32 or 64 depends on which shake is used, um and here we specified the length the shake a boot lens for each of those use cases.

J

So this lens, basically just to make sure that the shape function is executed only once, and that would be enough outputs for the mass value.

J

So that is the efficient of the the shake to be used at the mass generation function for the salt lens or we just want to oppose, may be easy by specify either 32 or 64. Bytes depends on which shake is used. I can't.

A

Remember but does 40 55 impose that salt not be zero.

J

That we we not right now, we have not set anything you'll, propose anything about how the salt should be the last bullets, as.

A

J

J

Yesterday, I would just say the lens, but we should have been mobile sick about how how how said should have been generated as well right.

A

Now I'm asking you explicitly about the salt length: I haven't looked in a while, but I think 4055 allowed assault length of zero.

J

I think the stand of the you couldn't standard doesn't say any restriction about assault lens as far as I know, but it's just a new thing to make sure the the security should be properly handled. So.

G

The salt length and 4055 the shortener the default is 20 20, 20.

J

That was used for shell 1. Thank you. Yeah.

G

A

But but thank you for the memory I think.

J

The intent for 20 was the standard was developed to bring using sha-1 at a time mm-hmm.

I

For what it's worth for, it's worth in TLS for requiring salt greater than or equal to, and the signature requiring greater or equal to the natural digest length all right. That makes sense. Now that I've course you don't place any requirements on what has to appear in the senator carlucci had felt right.

I

It would sure be nice to not have this syntax, but I guess we're past. Our kind of this is like just like a mess.

A

It is more complicated than I would like, but this is imported from pkcs1 I.

I

Recognize that yeah I mean it's um well like I would actually prefer just to just define you know, ID or SAS sa PSS shake 256, mm-hmm and actually I I mean I guess so it's worth considering whether we should just do that. I mean it's not actually, particularly to like I mean like as a consumer of this to of the stock technology. Is that actually helpful to have to like parse that PSSA and then parse this crap?

I

um And given that we're now, basically defining you know new algorithms I, don't know like I mean sleeping me out of an opinion, I mean this is like this is a show right, so I'm gonna get out of it, um but I I can't decide like I mean like like I, keep hoping that, like maybe like you know like. Maybe you have it I mean me ventually, but I only have the ones that are if we started doing good ones when we have the ones that, like totally helpless.

T

Ryan sleepy yeah, so I agree with that I. We we've had a lot of talk from an implementer side for RSA SSA PSS and the the notion of having you know our ID, our SAS si ESS shape you know. 128 is certainly preferable. The idea of the variable complexity- even you know, with this of configuring, the salt line for shake and then throw this in, is not something from an implementer and from an ecosystem standpoint that we'd be terribly thrilled with at least on the public, PKI I.

T

Don't know if there's a use case for this flexibility in the private side.

G

Shawn Turner again it it's actually worse because of the way this this index is set up is default, so you can't ever not leave include those things. It's bright.

J

G

It's always gonna be bigger, so correct, I, guess I wouldn't be fully I'd, be happy with doing just annoyed. That did everything.

U

Yeah Ron Thompson +1 I've had to review code that implemented PSS I didn't write it and I'm glad that I didn't have to because it's awful and it's the as Ryan said it's for land mines, interoperability disaster. Basically, so let's just make an avoid. It's easier.

Q

This is from Sean Leonard he's asks, if should the shakeout put lens length requirement, be expressed in Assen that one as a size constraint and similarly for RSA, SSA, PSS params salt length to restrict size to 32 or 64 accordingly, Jim's.

A

E

E

I'm, actually gonna get up here and say: yeah I, think actually just changing to a new weight is actually a good idea.

E

The flexibility here was Ashley so that you could have different mass generation functions and you can use different hash algorithms in all three locations, and we immediately followed that up with the advice which says, use the hash same hash algorithm in all three places, because that's the only way we know it's secure, so there's a whole lot of flexibility here that we can just eliminate no one, no one that that we've ever run across is using different mass generation function and the hash functions are always going to be the same.

E

So there's no particular reason to give us the flexibility for that relative to using the constraint yeah. It's not written in to begin with to let you do this thing constraint having that information is just going to be a pain.

J

So I'm hearing is you you're happy with required in the the hash, the mass generation using the same same shape, function and also the acquiring the basalt land to be fixed like this would be? Would we find as well no.

I

No, what I mean yes, yes, but I mean but I mean we're advocating defining annoyed. That only has one value for each these parameters. I mean there's a so ceated with one value for these parameters and therefore the salt length would be exactly one value, I mean and yes, the the parameters you select are the right parameters, but when we're suggesting is like having a wouldn't yell them down, yeah.

A

I I think what he's suggesting is that the first line change to ID RSS, a PSS, shake 128 and then say when you use that it means and say all the things then define the same thing, shape 256 and say when you use that it means all these things. So you get two IDEs no parameters, yeah.

T

Ryan's like plus one to that is, is that all of the parameters are fully expressed within the oeid. Every time we've seen a permutation of parameters as applied to both TLS and the PKI. It becomes an interoperability mismatched both on policy and implementation. So the one way that expresses everything you want to configure plus one.

J

Q

One more question from Sean Leonard he's asking for clarification, which could which component or components and forces sighs constraint because it won't be the SN dot. One encoder decoder.

A

V

E

A

Parameters so that.

E

Okay, I'm pulling out of memory as I actually would need to go back and double-check this. But in point of fact, my if I remember correctly, the salt length is actually was. Is there as an imposition from the public key to the signature algorithm and the actual value it? The verifier does not actually use that value. So you don't you don't care what the salt length is when you verify the signature, because you don't know what the salt is anyway, but I have to go back and double-check that but I'm not I, think that's correct.

E

A

Can't believe we created a parameter that the recipient doesn't need that doesn't feel right.

I

But the third full, the third photograph of five to describe is like told you, there's no salt likes parameter and tells you you have to check that it's greater than or equal, I suppose as possible. It's not passed into the into this integer computation function might be surprised.

I

So I knew the validation worked, really I, don't think that doesn't feel right not to go read it remember how picky I thought PSS was like done like a la the official way to do. Pkcs1, where you, where you weave forward, generated the block and then just compare no, so then you must need the salt. You must need the salt length because, like you're not doing it is like there's no way else. That's all to go right. I think it sets the line between the two that.

U

Funky little feistel network thing is so Martin, Thompson, I think from memory. You need it, but you need it because it might be greater than the length in that in the spki. So I think that.

A

Okay, but we're gonna nail it down.

U

Against a photon right, yeah, okay,.

A

Quinn is the direction clear yep. Yes,.

J

um Okay, so it just copied the do IDs for public keys over here from the RFC 40 55. No, no! No! That's.

A

H

J

Is a public key identifiers copy from IPC 32, 79 and 40 15 right.

I

Bye children, you're gonna, need new IDs for the public keys when the PSS public key is right for right, I mean by the way, these just to be clear. It's like PS s, public the whole. This whole like PS s, only like keys, is like itself a menace. Oh honey, like I, mean if you're gonna do it, you should do it. They should do it this way right, okay, so we do. We knew it and you're gonna need your knee.

I

You're gonna need two new ones that you use both in the signature in the public key and I'm. Assuming that your continue to operate the situation, that a public key which has RSA, which had which has RSA encryption, is valid for any any combination of PSS parameters. Right.

I

I

Basically, that you can use an RSA encryption key to sign it with to sign with RSA PSS, whether expressed with the parameter syntax or the nooit syntax.

I

Okay, this is making it much more like a lip to curve algorithms. As far as the the key, the key thing is mesh.

J

All right um next slide um yeah and we had this security consideration section and it's copied most of the text from the previous RFC, and we just talked this crap about a chase function as an addition, information to the section we fundamentally saying the they are deterministic functions. So when you you don't generate multiple outputs from the same input multiple times.

A

J

I have one question for the year for the chain for n for the group. um Should we say something about how the salt should be generated in the documents.

J

Because why now we're not saying how the salt is supposed to be generated at all, which is say, salt, so either salt should be generated from some random sauce with a good hash or the pseudo-random function, or the salt could be generated from a random Vasudha, random values or and a private key.

J

So in case it if the the random sauce is is lousy, bad, they privately could give the additional security benefit to it. For example, I run in the the shake over this salt can connected with the private key. So basically, the salt would be like a randomized value for the private key as the the the key generation secrets.

J

I

Would you put that guidance in this document? I, don't know I'm asking if you should not put that guidance in this document, yeah.

A

I think if it goes any work, it wasn't pretty else. One. Oh yeah.

E

And then point in fact what pkcs1 says is the randomness is not critical to security.

J

They're, the salts got to be unique, and if, if you, if you how you made it unique, no.

I

I

J

That is, that is in the paper or in the standard in.

I

Pekin serious warm the RFC says in situations where random generation is not possible, a fixed value or a sequence network could be employed instead with the resulting approval, security similar that of fdh.

J

Okay, so I take it I think that is a face value IIIi.

I

Don't know I've read that I remember that paper I got really long time if ever I'm just playing what it says: okay, okay, clearly and clearly. If a counter is okay, then it doesn't. That is not important to how the things seeded, with like a strong, strong key, exactly I.

J

So DC mask documents it it has similar, I, say and, and II see they say sections from the previous documents. In this section there is the DK Mac which it used to replace the the H Mac for CMS.

A

So I'm not sure it's worth going through the details of these slides, because I think what the advice of the group will be once you change the oils in the P. Kicks document change this one to follow. Correct.

J

And could we go straight to the K max section sure.

J

Here um so basically, K Mac is what we use in from the nist SP 800 185 and.

J

Follow that and we make a fixed lens for the output size, he do 126 bits for the shake 128 or 5 bits for shake 256 to make it symbol and- and so I don't know. If the group would like some flex beauty for the Albert lands or the group would be happy with the fixed lands like life in the post. Right now,.

A

If it would require or parameter.

J

M

J

So fixing everything would he'd use their parameters already, move them all. No.

A

My understanding is, she would need a parameter for the length.

J

Yeah coded with an Audi the hash function, we we fix, we don't need. The thing is the employing the hash function requires the parameter, but if, but if we could change the the Oh, a DS for the hash function, with our parameter that that would be possible. However, that would would make a little more convocation in a mass generation function, because the mastery function, the output lands for the hash in a mass generally function, is different from the output lens or when it has it used in hashing messages.

J

I

J

For hashing do I now, for example, shake 128 when you use the shake as a hash function, output lens right now: Ben benefits 256 bits. Yes, but when we use the hash in the mass generation function, then the Len is going to be equal, the size of the modulus, the hash it has values, lands and minus 1.

J

That is the lens for the shake 128 when it is used in a mass celebrated function. To avoid repeating execution of the 80 shake itself multiple times.

I

Okay, I thought you were talking about the encoding, but maybe I'm misunderstanding something. I.

A

Was you were ok here.

J

So right now, as you define the hat, D shake 128 256 whenever the OID for either one of those is used, the pyramidal output lands must be accommodated along with it, because there are two situations at least four different lens. The first one is 250 sickness, for example, shake 128 when using as a hash function and all the output lands is number the modernist size miners. The hash value minus 1 when shake 1 today is used in the mass generation function, but.

I

You never have to represent that annoyed, because the oeid will the MGF doesn't have to be um GF for RSA right.

J

I

You never have to represent that you never to represent that weight on the wire, because you just that the the only way you represent is the one we just agreed on the ID RSA blah blah blah yeah. Well, we.

J

Could do that we could do the arm. I mean.

I

J

It but I'm say where, when people? Okay, when we when, when when you pass the mass generation function, oh you can were to make a fix. Ok, yeah.

I

They basically like fix everything. Ok, you fix everything right so, like so be a be a lookup table. Lets tell you what to do right based it so then. So then, usually you need. It seems to me. You need three separate lights. You need one annoyed for on the 108 for like shot three from three central groups of whites, only for shot three as a digest function, one annoyed for RSA with like each variant of shot.

I

Three and one wait for Shaytan one a for each variant for each shake variant with each frames or sell three, so you'll need what I guess have mm ah three, so you need six ones as far as I can make out.

A

I think two of them are already assigned, but okay nope.

J

But would you be okay with the the Oh IDs off the hash functions or half the output length parameter I.

I

Think they shouldn't like, why will I need like they have native sizes right? If you want it, I mean that seems like use. No.

A

Nobody's the other hash function, usually other Shaco. It's the one that nails down the out path there. There are those already assigned nobodies.

J

The dead that would have some problem we need to solve in the master agent function because in the mass generation for me, we want the output Lance to be a lot longer than 254.

I

Imagers never represent on the wire right.

J

But how okay so so, which is.

I

The parameters that resolve the water are one hash hash function for when you need to do like I guess for when you put at the front of like a CMS message right, um one to the the type of the RSA key which is associated with which now we've agreed is associated with all the all the sha three values: hello, no I'm, just I'm, just talking I'm, just like like all possible ways with like the union of these specs and as far as I can tell six and whites um one, the pair hash, one, the combination of RSA with each hash and three, the shake combination with each hash, which I want to have a fixed output size, which is the natural size of this digest right.

I

um So, okay, so and you never need represent and when shake I agree, shake is used as mg as an mg F. But you don't need that doesn't need representing the wire, because that's implicit in the oeid assignment. We know RSA and Shari I I.

J

Know but the for the for the current specification of the the Vickie says standard. The mass generation takes two parameters: one is the these source and output lands yeah.

I

I understand but we're just gonna write.

J

That down you're.

I

Gonna say when you love the way those values.

J

Are so okay, so so, basically, so that the safe function will be used differently from from the normal hash function, I correct, yeah! What.

I

Being coded differently, you use the same way. I. Imagine.

J

All right um do you know what to do I, I think so, um but yeah I'm, seeing a about the the lens output in a massive range of us. You know: that's, okay, um I go go with that! Okay,.

A

You can bring it to the list if you get confused. Yeah will.

J

Do so what see what its next slide yeah yeah next slide is asking for comments, questions I, think.

A

J

H

J

Attention in the comments and we improved the the documents one more time.

A

Philips up next.

N

So we had a little incident, so at first got interested in this when or basically the incident happened like this, a an affiliate to one CA decided to change to being an affiliate to another CA, and so, as part of that switchover, they said to their first CA. We would like you to revoke all your certificates, because we've just reissued them for the other CA okay. Now, firstly, it is ca, said no.

N

We want to keep those certificates because you are not the subscriber and therefore you don't have the right to revoke so affiliate then sent an email containing a list of 15,000 private keys for said certificates saying: okay now they have been compromised revoke, which CA did so. There are two separate questions that interested me here. One one of them is well shouldn't. We have a better way of proving compromise of a certificate, that of a private key rather other than actually posting the private key itself.

P

Right so basic.

N

P

N

A standard for a suicide note and I asked Russell rusts contributed the first five bullets here and then the Acme folks said. Well, we all should also have a revocation message. So that's one issue: Jim is about to tell me another one, yeah I'm, about to tell you no crl to list yourself. Yes, now that that is actually my preferred.

N

One would be to simply have a crl signed by the certificate itself, because that's what one that is, probably the easiest to create with existing toolkits, so I mean like one work possible work item for a group. The group is okay, we've got six possibilities here and Jim's just added a seventh. We should have one well we'll need to have one if we're going to expect anybody to do it.

N

So that's one area, the other area, which is more kind of like a research item that I think people need to pay attention to is why did that see that affiliate have access to 15,000 private keys, and this kind of like had me really puzzled until I started to think about what that affiliate was doing in that what they were doing was.

N

Essentially, they were a technology provider to a webs, a web hosting provider, and they were almost certainly managing the whole crypto interface for the web hosting provider, if not more and the that is a very common thing in our industry. Now, in that you have technology providers who are managing multiple web hosts on a cloud infrastructure and what they will be doing is pulling a host from here and moving it to there and moving it from here and when you think about the management that those people need.

N

Of course, the certificates, the private keys, are going to end up in some database somewhere, and so that's a point of vulnerability. I think that we need to be aware of and start to think of ways of maybe avoiding the nee providing the ability to manage all those cloud services without having such an enormous single point of failure.

N

O

Tim Holik there are a bunch of other one. This is a very hard incident to discuss because of the fact that there are a bunch of really interesting things that happened and it's not a particularly one probably wants to base ones best practices off of hypothetical occurrences in which people are actually interested in following best practices right.

O

One of the other ways that these people, like one of the other reasons that they likely had the keys around, was because, in this particular person, was generating the keys as well, and one can hyper hyper that many of the keys were stored just because they were generating them and they didn't necessarily have a need for them and just happened to be storing them.

O

And if you look at some of the practices that existed around this incident as well, including you know, cross-site scripting vulnerabilities that allow you to get rude on the host, even if you did have a best practice for demonstrating, revocation I, think there's very good evidence that we still probably would have received a zip file full of private keys. So you know I had to spend an entire afternoon. Writing a best practices document, there's a lots of things around these providers, and things like that. That probably could be improved.

O

It would be great, I agree. We really should have a discussion about what our best practices on ground revocation request, because everybody's doing it differently and a lot of the methods do not have particularly great properties and I agree that disclosing a private key for the purpose of proving that you have possession of it is perhaps something we should ban it slightly slightly different from awesome, which I heard right next to me from somebody who probably would like would be willing to say that in public yeah.

N

I I don't really want to focus on that particular case. Yeah.

O

That's that's. Actually the direction I was going. Yeah I think discussing that particular cases. That's just a nest of zaniness, so we should think about your case is actually much more interesting cloud providers that have a legitimate need for having these keys and things like that. Well, at the end of the day, any area.

N

Iii I have a large number of websites as a large number of accounts, only some of which you remind which would be associated with me and yeah.

N

I keep well I used to keep tabs on my competitors, I, don't know why I'm doing it now a lot of the time you can just say: I want SSL on this website by clicking a button which means that that key is being generated for the subscriber which and then it kind of like whizzes around this data center. So yeah.

O

And if you're doing that, I mean the other thing and it's not so much an IETF issue. But if you're doing that you should public you should be. You should have to publicly disclose that you're doing that.

K

Paul Hoffman, so I don't think that this is a good forum for figuring out best practices in policy, giving people a way to do something, especially if it's just one way I think is certainly appropriate. But going back to the very beginning of what you said this C. You know that this sub C, a I called them, um had a legitimate desire. They ended and they were told. No, you know, and so they ended up sort of forcing it.

K

But I think that a thing that we could consider as well is, if you have a legitimate desire to do a mass revocation or whatever will that fit into one of the ways we're doing it here. That is, should we then say, as Jim would say, create 20,000 CR ELLs, uh you know one for each one.

K

Should there be a way of Matt of doing masking, for the exact reason that you brought up at the very end, which is in fact there are a million private keys that are not held by the people who own the websites, and there is often very legitimate business reasons for moving from one CA to another, especially the CA might tell you. Oh I'm. Sorry, we've changed our name with changes.

K

You have to do this, so I think that that this should be in scope for as we're figuring out the methods it might be just suck it up. I, don't care how many you have create that many CR ELLs, or that many revocation requests or whatever, but I think that that should be part of the use case. Yeah.

N

I mean I I, don't have a solution yet I'm, not sure that I will have a solution, but I I thought that we should I should raise it so that then we can start thinking about it, and it may be that in the medium term, we end up wanting to change. Tls and other things in order to facilitate I mean short-lived certificates might be part of the mix here.

N

I

I mean if you do want to have a suicide note, one important property that says suicide, note what to be that it can be generated immediately upon receiving the key and is not to be timely, because one cup, one situation is my. My mic, like I, have a key on my machine. If you in stolen and now I can't I can't generate a cancer interpretation, so I I've involved about how acnes request works, but I. Imagine it like all their Acme requests.

I

It has some TNT before the mechanism and in this case you don't want any view for that. Catism, that's undesirable, because, like so um so yeah I mean you want to be able to regenerate it. A.

A

V

Thank You Russ I'm here to introduce a potential draft that we have posted about a week two weeks ago. It has to do with allowing x.509 certificates to contain multiple public keys and multiple issuer signatures.

V

Now the motivation for this was we were looking at all the migration that we're gonna have to do when the post quantum algorithms become available, and if you think about key establishment, I mean that's negotiated between two peers and it's all easier to update in phases. But when you think about authentication- and we depend on the certificate chain that is issued by a PKI- that only has a single algorithm in it and we can't really migrate unless we duplicate infrastructure duplicate certificate chains.

V

So what we were trying to do is create a certificate that we that would have both algorithms and then the application can choose one versus the other.

V

So what this draft describes is a hybrid certificate of sorts. We place alternate public key and signature inside the non critical extensions, so that existing clients can process these certificates and ignore those extensions. Now, if that certificate is processed by an upgraded system, then it could ignore the classic signature and go to the quantum safe one, and so essentially the way it's done is by layering signatures. We take all this certificate attributes, including the quantum safe public key.

V

We sign it using a quantum, safe, private key of the issuer, and we place that signature inside a non-critical extension as well, and then we sign it using a classic key. Now, this type of certificate is a little larger than the ones we have right now, but at the same time, classic systems can process it without failing so, we've done a number of independent experiments between the three companies that worked on this format and we have posted the draft describing in detail enrollment, revocation everything on it.

V

So if you have any questions, please ask them now or post them on the mailing list.

N

Have you looked into the IPR issues because certain comm used to have a patent on this? We will be looking at that yeah I mean it may be expired or expiring, but it's a nice.

N

K

Hoffman um we may be heading towards a world where there are multiple post quantum algorithms that are chosen. Some. Would you know one that a world that I've heard of is an algorithm with small keys, large signatures and then another one where it is large key, smaller signatures and what I didn't see in your document was a way of multi signing the multiples. Is that something that you're intending to do or you're, assuming that CA is going to have picked one for creating the certificate? So the motivation.

V

For this was migration so that legacy systems can process these certs yeah. That is why we only had one algorithm edit. Now nothing prevents us from adding multiple sets of those extensions or creating a hybrid signature of sorts where the oil describes multiple signatures, and then the signature is a concatenation of multiple signatures, so I mean.

K

I certainly hope those worlds don't appear and that we get one but from the tussle that we are hearing those of us following the NIST list. I I believe that there that we will be worse off than just shot two and sha-3 I think we there's a reasonable chance that NIST or whomever or NIST Plus whomever is going to end up that we might have three or four to pick from right. So, okay, great okay, I, just long as that's something in your mind, because I didn't see in the current one of that.

K

You can't assume that everyone's going to pick one post quantum all.

V

Right I agree in this something again we considered and we're interested in hearing you know feedback from everyone to see which way is better. Is it better to create a hybrid signature, wait and.

J

V

All in one extension or have multiple sets of extensions right, I think multiple sets of extensions will complicate the format a little bit. You're.

K

Talking about a pea kick certificate already! You missed complex by over twenty years.

I

So these are going to be quite large right, depending.

V

On the quantum safe I'm.

I

Assuming you're using hash, integers right well, I guess things like we've.

V

Tried with LMS and Elysium and then Sphinx is in the works to try it out right.

I

Spain we're talking about something. That's in the order of like you know, several thousand, not cats right sure. So that's gonna make the that's. Gonna, make people fairly sad.

I

Yeah yeah right um so I mean the thing is that so I'm gonna said something like I'm, not sure I'm like like very much either but um I mean certificates like this will be almost unusable in like any like any web context because of the two of ours right and no one's gonna. No one's gonna take two more MSS is to deliver the certificate, so one in in in so in general, is a problem in in the interactive context.

I

So the one thing you might imagine doing is actually emitting this, inter um the emitting the post, columns, integer or placing with essentially a digest of the post quantum signature and treating that as a promise and then delivering this, the sir that the the offending party separately and so the way this would work would be. Do you think any imported get two things we get? It would effectively get a. We get a um we get a certificate that was a such a classical certificate.

I

um We have a set effectively a promise for the for the put for the post, quantum signature and potentially a problems for the post quantum key to, and then it would get a separate object which and then went and with a client and then, as I can tell last, the client would say: look I, won't post quantum and then you deliver.

I

You know you deliver the cert and you deliver the part of the things that fall, the promise separately and so that way that way, not that way, no, not every else in the world has to absorb, like the extra I mean if you want to get ready, grow employment, like basically new servers, gonna, accept like having that big circus mansion. But if talking about big expansion of like you know, seventy bytes, that's the sort of story, and people might take that so I don't know like I've involved about it really clearly.

I

So um maybe you don't care interactive context, but.

O

It would also support caching, if you already had it yeah, okay,.

I

Again, I'm, just damping at the mic here so like, maybe, is a terrible idea, but I can tell you it's a real problem for serviettes izybelle problem. Thank.

V

You and the main motivation for this was migration to post quantum, but the way it is designed I mean it's. It's it's algorithm agnostic right.

A

So we kind of had this problem when we address logos.

I

A

Had something big and you didn't want to shove it in there, so you put it somewhere else, put a pointer to it in the certificate and then put a hash of the thing that was over there. So no one could play cut and paste attack. Okay,.

V

Thank you, yeah.

T

So Ryan sleepy I just want to give a plus 1 dagger suggestion when we look from a browser perspective at the real world deployment of OCSP stapling, for example, this is actually one of the concerns that comes up the size of the OCSP response being delivered in the handshake. The fact that you're delivering it to clients that mary have the OCSP handshake, so the caching matter that the 10 mentioned so putting it in the certificate in the fact that you need to deliver this to downlevel clients becomes a problem. So in looking at what this.

T

This looks like the idea of a negotiation who opted into this, whether it like the TLS level, etc. Acura solution, I, think, is probably cleaner because it it is within that bound of overhead that you could probably just send it anyways, but for something. If you do go down this route, then it's it's more than likely going to be that you have multiple certificates. You have the down level certificate that does not have any repost quantum, precisely because you need to support client to simply do not care about that.

T

The same way that you need to support clients that don't care about OCSP stapling and you don't want to shove a no CSP response to them if I not going to use it. Thank you.

G

Hi Sean Turner I mean this also brings up the other thing that we talked a little bit earlier with you know the the the UM the supported stuff for sy I'm. That's one capabilities. You got the old in the new and which one do you do and if one doesn't work, you know you take the new one and that's a policy thing, and we don't know what to say about that, and we've tried that a couple of times the ITF and we pretty much fall on her face so I'll be curious to see.

G

If you put tune in one or two or more in right, then you figure out like which one's good and I don't know and I think this is like the third algorithm, that's post quantum safe, so we have to decide which one is: post quantum, safe and I. Don't know. That's that gets to be kind of challenging. So I guess I. Just think that I think there's lots of dragons in this space and I still think that having two certificates just makes everything a lot easier.

G

A pointer to the other promise essentially seems to make much more sense than trying to put two keys in or two other sets a signature values.

L

Q

This is Sean, Lennon again was actually a similar comment. He says they digest in the pointers. Subject: information access like a URI Thank You.

U

Martin Taunton, my initial reaction was the same as Sean's, but just thinking through eka suggesting a little bit more I think that perhaps we're gonna need to talk to the TLS working group. For this one that's unfortunate, but they they're kind of busy right now, but they are.

O

U

Busy very soon yeah, but the key point here is: if you are going to make a promise, you then have to define a mechanisms by which you've fulfilled that promise extension. This might not work in this case. What, because it well that there's someone certainty as to whether or not you're gonna get something that needs.

I

Fulfillment so I actually was thinking about. I was thinking about this precisely for the purpose, precisely the cuts to TLS, and so so bear in mind so I'm. Assuming that you would offer a I'm assuming you offer two extensions, one extension would be the signature algorithms, which said like, which would only have a place one algorithms and the second would be a placeholder extension which would allowed these. We still have the server to send you in the certificate entry, the things of full the promises.

U

I

No, no, the server will be smart about you spread this already smart about it always ended, only send it yeah.

V

So the experiment we did with TLS is what we did. We in TLS 1.2, we modified the NSS and we configured the Apache to have the certificate with two signatures. So then it would enable two types of cipher suite to two different signatures on there now, depending on the client. If you only understand the CDSA that would be negotiated or if you understand post quantum and then the server will just send a same chain but then sign that div Hellman key using a different private key.

I

Technically works, fine, but the consequence is that you've made the service light much bigger and like we had a lot of trouble to keep the server's first light within the initial initial Seawind. And so, if you make the thing, though, it's bigger, you don't you gotta, see wind, and that makes everybody really sad. So, like like I mean it's like pretty important good small again mr. banner I mean for CMS, maybe doesn't matter, but for like, but or maybe does betting for any interactive protocol that has congestion control as part of the handshake.

I

It's a critically important, conserve small.

E

One of the things that slightly worried about, if you do the indirect step, is it be if you have a TLS URL to go, get the your your Eirik. So your external key and you need a external key to get that when you may just kind of turtle your real self down.

I

As well just me not anywhere else do magic.

Q

This is Sean again. He he wants to know what the implications are of having multiple public keys with the same certificate subject, namely the certificate serial number.

Q

V

Well, the whole idea would be the same identity with the same subject names in serial. It just has two different. You.

G

V

Keys that he could use to sign, digest yeah.

U

So some Martin Thompson. How would you imagine this being used in a context like Tillis? Would you get both signatures over the handshake, or would you just pick one or I mean? Are we going to identify? Are we going to identify this by saying I want the the X MSS signature of the hint or well that'll be fun, wouldn't it or I'm willing to take the combination of that and something else there's a bit of a combinatorial explosion there. That goes on that we record to think about a little bit.

U

Well, does somebody think about because in general the idea is great, but the details are nasty yeah.

V

Thank you and just a comment on a multiple certificate chain idea: I mean yes, I mean there's one way to go, but if you think about large enterprise, then you have to let user or the application select which credential to use where you know. If you bring it all the way down to the protocol level, it's a little simpler in terms of.

A

Support and management, it's a trade-off right, it's a it might be simpler for the user. I always pick the one and only credential I have, but now, with the the complexity, moves to the protocol.

I

Like mostly protocols already do have mechanisms for selecting for letting different surrogate change, so you can support first, this RSA NEC, DSA or ECDSA, and easy to find one night. So I think you know like there's, no seem clever, but it's not entirely clear to me what it it's better to have you multiple chains and it certainly has a dream in central Hardin vessel many mechanisms are gonna. Look the kind of blow us talking about so I mean I.

I

Guess you know, I mean it's not means it's, it's it's not I mean I mean commercially, might think. It means they're like like.

I

It seems like that in some case, we've got having hybrids and so like as obvious about that and like I can imagine like so one thing that imagine a very sensible, hybrid we'd be a post quantum key key establish an algorithm signed with a with a classical signature algorithm. That's the extremely sensible, hybrid right because you say like because you say like look how I I. Don't trust like you know, I, don't trust crossing out the cost of called key change against.

I

You know against future or like compromise, but like I trust, but I thought as far as I know, there's no there's, no quantum graphic attacks as integers and if there were like I, would cut over then, but, like it's not so clear to me what what this does, because, basically it's either I mean if I just have two parallel infrastructures, one for the post, one for the post quantum and one for classical sound like doesn't make any sense and I have take it.

I

Take that post take the you know to use the post climb signature to verify the classical as in Zagreb medicine, like that's good right um so yeah it seems you have a two silo, so it's not creamy. Why mirja name is sensible. I guess I got a little carried away, trying to like actually design anyways orchestrate. So thank you so.

A

The last agenda item is just a heads up and we have one minute left, so it seems to fit draft Housley CMS mix with PSK is a technique for adding a pre shared key to an existing diffie-hellman or RSA key set up so that you are able to provide some protection against the invention of a post called a large-scale quantum computer.

A

If you have a pairwise pre shared key, this technique, I think doesn't make a lot of sense, because you should just use that and use the CMS encrypted data technique, for example, but if you have a key that you've described to a group and then use mix it with the other technique, disclose the creation of the large-scale quantum computer, we'll expand the scope of people who can deal with the back traffic to those who have that preacher key. So all's this is is a call for.

A

Please take a look since the CMS experts are the people here. I appreciate the review. This is the end of the ITF for this time, all right, if 101 I should say safe journey home, and thanks for you.