Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Added a P256 variant #97

Merged
merged 18 commits into from
Jan 29, 2025
Merged

Added a P256 variant #97

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
18 commits
Select commit Hold shift + click to select a range
bec5538
Added a P256 variant
ounsworth Jan 5, 2025
304a347
typos. Thanks Ilari
ounsworth Jan 6, 2025
54e95c7
Fixes header of algorithm column in all tables.
Jan 22, 2025
b18ab70
Removes prehash from algorithm names in IANA section.
Jan 23, 2025
6d0a5b8
Update draft-ietf-lamps-pq-composite-sigs.md
ounsworth Jan 27, 2025
d01af43
Added a "Why Hybrids?" security consideration. Closes #92
ounsworth Jan 28, 2025
64aed9d
Adds rationale for use of SHA512 with MLDSA-44 in CMS section.
Jan 29, 2025
0206e33
Merge pull request #107 from lamps-wg/98-problems-with-the-use-in-cms…
johngray-dev Jan 29, 2025
4e6541a
Removed the harvest not decrypt later and kept long term signature
johngray-dev Jan 29, 2025
3d86dbe
Merge pull request #105 from lamps-wg/mikeo_92
johngray-dev Jan 29, 2025
c7cce41
Merge pull request #104 from lamps-wg/102-remove-prehash-suffix-from-…
johngray-dev Jan 29, 2025
7aa667f
Merge pull request #101 from lamps-wg/81-typo-in-algs-list-table
johngray-dev Jan 29, 2025
e659308
Added a P256 variant
ounsworth Jan 5, 2025
cf867fb
typos. Thanks Ilari
ounsworth Jan 6, 2025
32ac139
Merge branch 'mikeo_p256' of github.com:lamps-wg/draft-composite-sigs…
ounsworth Jan 29, 2025
c2edf17
Update the ASN.1 OID definitions
johngray-dev Jan 29, 2025
120e1f2
Fixed up OIDs for new P256 combination
johngray-dev Jan 29, 2025
46fd923
Update the Composite HashML-DSA OID table
johngray-dev Jan 29, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
35 changes: 34 additions & 1 deletion Composite-MLDSA-2024.asn
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -253,6 +253,21 @@ sa-MLDSA65-Ed25519 SIGNATURE-ALGORITHM ::=
pk-MLDSA65-Ed25519 }


-- TODO: OID to be replaced by IANA
id-MLDSA87-ECDSA-P256 OBJECT IDENTIFIER ::= {
Copy link

@ilaril ilaril Jan 5, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Should this be ML-DSA-65 instead of ML-DSA-87? The other changes seem to be for ML-DSA-65+ECDSA-P256 combo (e.g., id-HashMLDSA65-ECDSA-P256-SHA512).

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Oops. I must have been tired or drunk when I wrote this. Good catch.

joint-iso-itu-t(2) country(16) us(840) organization(1)
entrust(114027) algorithm(80) composite(8) signature(1) 71 }

pk-MLDSA87-ECDSA-P256 PUBLIC-KEY ::=
pk-CompositeSignature{ id-MLDSA87-ECDSA-P384,
CompositeMLDSAPublicKey}

sa-MLDSA87-ECDSA-P256 SIGNATURE-ALGORITHM ::=
sa-CompositeSignature{
id-MLDSA87-ECDSA-P256,
pk-MLDSA87-ECDSA-P256 }


-- TODO: OID to be replaced by IANA
id-MLDSA87-ECDSA-P384 OBJECT IDENTIFIER ::= {
joint-iso-itu-t(2) country(16) us(840) organization(1)
Expand Down Expand Up @@ -417,6 +432,24 @@ sa-HashMLDSA65-RSA4096-PKCS15-SHA512 SIGNATURE-ALGORITHM ::=
id-HashMLDSA65-RSA4096-PKCS15-SHA512,
pk-HashMLDSA65-RSA4096-PKCS15-SHA512 }


-- TODO: OID to be replaced by IANA
id-HashMLDSA65-ECDSA-P256-SHA512 OBJECT IDENTIFIER ::= {
Copy link

@ilaril ilaril Jan 5, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is it intentional to use SHA-512 with ECDSA P-256 (which usually uses P-256)?

The SHA-512 hash will be truncated to 32 bytes (This is not the same as SHA-512/256).

Regarding speed of SHA-256 versus SHA-512, on 32-bit SHA-256 is faster, and on 64-bit SHA-512 is faster, unless there is hardware SHA-256, in which case SHA-256 is faster.

Copy link
Contributor Author

@ounsworth ounsworth Jan 6, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is intentional. The full specification of this cipher suite is:

| id-HashMLDSA65-ECDSA-P256-SHA512            | <CompSig>.XX  | id-ML-DSA-65 | ecdsa-with-SHA256 with secp256r1 | id-sha512 |

So the EC part is ecdsa-with-SHA256 with secp256r1. The SHA512 is a pre-hash common to both components, and since MLDSA65 is a NIST Level 3, this must be at least SHA384. We received feedback that SHA384 is not well supported so we should only use SHA256 and SHA512, so then this has to be SHA512.

Complicated, but that's how we got here. This is intentional.

joint-iso-itu-t(2) country(16) us(840) organization(1)
entrust(114027) algorithm(80) composite(8) signature(1) 82 }

pk-HashMLDSA65-ECDSA-P256-SHA512 PUBLIC-KEY ::=
pk-CompositeSignature{ id-HashMLDSA65-ECDSA-P256-SHA512,
CompositeMLDSAPublicKey}

sa-HashMLDSA65-ECDSA-P256-SHA512 SIGNATURE-ALGORITHM ::=
sa-CompositeSignature{
id-HashMLDSA65-ECDSA-P256-SHA512,
pk-HashMLDSA65-ECDSA-P256-SHA512 }




-- TODO: OID to be replaced by IANA
id-HashMLDSA65-ECDSA-P384-SHA512 OBJECT IDENTIFIER ::= {
joint-iso-itu-t(2) country(16) us(840) organization(1)
Expand All @@ -426,7 +459,7 @@ pk-HashMLDSA65-ECDSA-P384-SHA512 PUBLIC-KEY ::=
pk-CompositeSignature{ id-HashMLDSA65-ECDSA-P384-SHA512,
CompositeMLDSAPublicKey}

sa-HashMLDSA65-ECDSA-P256-SHA512 SIGNATURE-ALGORITHM ::=
sa-HashMLDSA65-ECDSA-P384-SHA512 SIGNATURE-ALGORITHM ::=
sa-CompositeSignature{
id-HashMLDSA65-ECDSA-P384-SHA512,
pk-HashMLDSA65-ECDSA-P384-SHA512 }
Expand Down
59 changes: 37 additions & 22 deletions draft-ietf-lamps-pq-composite-sigs.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1057,6 +1057,7 @@ Pure Composite-ML-DSA Signature public key types:
| id-MLDSA65-RSA3072-PKCS15 | <CompSig>.65 | id-ML-DSA-65 | sha256WithRSAEncryption |
| id-MLDSA65-RSA4096-PSS | <CompSig>.66 | id-ML-DSA-65 | id-RSASA-PSS with id-sha384 |
| id-MLDSA65-RSA4096-PKCS15 | <CompSig>.67 | id-ML-DSA-65 | sha384WithRSAEncryption |
| id-MLDSA65-ECDSA-P256 | <CompSig>.68 | id-ML-DSA-65 | ecdsa-with-SHA256 with secp256r1 |
| id-MLDSA65-ECDSA-P384 | <CompSig>.68 | id-ML-DSA-65 | ecdsa-with-SHA384 with secp384r1 |
| id-MLDSA65-ECDSA-brainpoolP256r1 | <CompSig>.69 | id-ML-DSA-65 | ecdsa-with-SHA256 with brainpoolP256r1 |
| id-MLDSA65-Ed25519 | <CompSig>.70 | id-ML-DSA-65 | id-Ed25519 |
Expand All @@ -1083,6 +1084,7 @@ HashComposite-ML-DSA Signature public key types:
| id-HashMLDSA65-RSA3072-PKCS15-SHA512 | <CompSig>.79 | id-ML-DSA-65 | sha256WithRSAEncryption | id-sha512 |
| id-HashMLDSA65-RSA4096-PSS-SHA512 | <CompSig>.80 | id-ML-DSA-65 | id-RSASA-PSS with id-sha384 | id-sha512 |
| id-HashMLDSA65-RSA4096-PKCS15-SHA512 | <CompSig>.81 | id-ML-DSA-65 | sha384WithRSAEncryption | id-sha512 |
| id-HashMLDSA65-ECDSA-P384-SHA512 | <CompSig>.XX | id-ML-DSA-65 | ecdsa-with-SHA256 with secp256r1 | id-sha512 |
| id-HashMLDSA65-ECDSA-P384-SHA512 | <CompSig>.82 | id-ML-DSA-65 | ecdsa-with-SHA384 with secp384r1 | id-sha512 |
| id-HashMLDSA65-ECDSA-brainpoolP256r1-SHA512 | <CompSig>.83 | id-ML-DSA-65 | ecdsa-with-SHA256 with brainpoolP256r1 | id-sha512 |
| id-HashMLDSA65-Ed25519-SHA512 | <CompSig>.84 | id-ML-DSA-65 | id-Ed25519 | id-sha512 |
Expand Down Expand Up @@ -1112,6 +1114,7 @@ As mentioned above, the OID input value is used as a domain separator for the Co
| id-MLDSA65-RSA3072-PKCS15 |060B6086480186FA6B50080141|
| id-MLDSA65-RSA4096-PSS |060B6086480186FA6B50080142|
| id-MLDSA65-RSA4096-PKCS15 |060B6086480186FA6B50080143|
| id-MLDSA65-ECDSA-P256 |XXXXXX|
| id-MLDSA65-ECDSA-P384 |060B6086480186FA6B50080144|
| id-MLDSA65-ECDSA-brainpoolP256r1 |060B6086480186FA6B50080145|
| id-MLDSA65-Ed25519 |060B6086480186FA6B50080146|
Expand All @@ -1130,6 +1133,7 @@ As mentioned above, the OID input value is used as a domain separator for the Co
| id-HashMLDSA65-RSA3072-PKCS15-SHA512 |060B6086480186FA6B5008014F|
| id-HashMLDSA65-RSA4096-PSS-SHA512 |060B6086480186FA6B50080150|
| id-HashMLDSA65-RSA4096-PKCS15-SHA512 |060B6086480186FA6B50080151|
| id-HashMLDSA65-ECDSA-P256-SHA512 |XXXXXXXX|
| id-HashMLDSA65-ECDSA-P384-SHA512 |060B6086480186FA6B50080152|
| id-HashMLDSA65-ECDSA-brainpoolP256r1-SHA512 |060B6086480186FA6B50080153|
| id-HashMLDSA65-Ed25519-SHA512 |060B6086480186FA6B50080154|
Expand Down Expand Up @@ -1237,6 +1241,7 @@ A compliant implementation MUST support the following algorithms for the SignerI
| id-MLDSA65-RSA3072-PKCS15 | SHA512 |
| id-MLDSA65-RSA4096-PSS | SHA512 |
| id-MLDSA65-RSA4096-PKCS15 | SHA512 |
| id-MLDSA65-ECDSA-P256 | SHA512 |
| id-MLDSA65-ECDSA-P384 | SHA512 |
| id-MLDSA65-ECDSA-brainpoolP256r1 | SHA512 |
| id-MLDSA65-Ed25519 | SHA512 |
Expand Down Expand Up @@ -1329,69 +1334,74 @@ EDNOTE to IANA: OIDs will need to be replaced in both the ASN.1 module and in {{

### Object Identifier Registrations - SMI Security for PKIX Algorithms

- id-MLDSA44-RSA2048-PSS-SHA256
- id-MLDSA44-RSA2048-PSS
- Decimal: IANA Assigned
- Description: id-MLDSA44-RSA2048-PSS-SHA256
- Description: id-MLDSA44-RSA2048-PSS
- References: This Document

- id-MLDSA44-RSA2048-PKCS15-SHA256
- id-MLDSA44-RSA2048-PKCS15
- Decimal: IANA Assigned
- Description: id-MLDSA44-RSA2048-PKCS15-SHA256
- Description: id-MLDSA44-RSA2048-PKCS15
- References: This Document

- id-MLDSA44-Ed25519
- Decimal: IANA Assigned
- Description: id-MLDSA44-Ed25519
- References: This Document

- id-MLDSA44-ECDSA-P256-SHA256
- id-MLDSA44-ECDSA-P256
- Decimal: IANA Assigned
- Description: id-MLDSA44-ECDSA-P256-SHA256
- Description: id-MLDSA44-ECDSA-P256
- References: This Document

- id-MLDSA65-RSA3072-PSS-SHA512
- id-MLDSA65-RSA3072-PSS
- Decimal: IANA Assigned
- Description: id-MLDSA65-RSA3072-PSS-SHA512
- Description: id-MLDSA65-RSA3072-PSS
- References: This Document

- id-MLDSA65-RSA3072-PKCS15-SHA512
- id-MLDSA65-RSA3072-PKCS15
- Decimal: IANA Assigned
- Description: id-MLDSA65-RSA3072-PKCS15-SHA512
- Description: id-MLDSA65-RSA3072-PKCS15
- References: This Document

- id-MLDSA65-RSA4096-PSS-SHA512
- id-MLDSA65-RSA4096-PSS
- Decimal: IANA Assigned
- Description: id-MLDSA65-RSA4096-PSS-SHA512
- Description: id-MLDSA65-RSA4096-PSS
- References: This Document

- id-MLDSA65-RSA4096-PKCS15-SHA512
- id-MLDSA65-RSA4096-PKCS15
- Decimal: IANA Assigned
- Description: id-MLDSA65-RSA4096-PKCS15-SHA512
- Description: id-MLDSA65-RSA4096-PKCS15
- References: This Document

- id-MLDSA65-ECDSA-P384-SHA512
- id-MLDSA65-ECDSA-P256
- Decimal: IANA Assigned
- Description: id-MLDSA65-ECDSA-P384-SHA512
- Description: id-MLDSA65-ECDSA-P256
- References: This Document

- id-MLDSA65-ECDSA-brainpoolP256r1-SHA512
- id-MLDSA65-ECDSA-P384
- Decimal: IANA Assigned
- Description: id-MLDSA65-ECDSA-brainpoolP256r1-SHA512
- Description: id-MLDSA65-ECDSA-P384
- References: This Document

- id-MLDSA65-ECDSA-brainpoolP256r1
- Decimal: IANA Assigned
- Description: id-MLDSA65-ECDSA-brainpoolP256r1
- References: This Document

- id-MLDSA65-Ed25519
- Decimal: IANA Assigned
- Description: id-MLDSA65-Ed25519
- References: This Document

- id-MLDSA87-ECDSA-P384-SHA512
- id-MLDSA87-ECDSA-P384
- Decimal: IANA Assigned
- Description: id-MLDSA87-ECDSA-P384-SHA512
- Description: id-MLDSA87-ECDSA-P384
- References: This Document

- id-MLDSA87-ECDSA-brainpoolP384r1-SHA512
- id-MLDSA87-ECDSA-brainpoolP384r1
- Decimal: IANA Assigned
- Description: id-MLDSA87-ECDSA-brainpoolP384r1-SHA512
- Description: id-MLDSA87-ECDSA-brainpoolP384r1
- References: This Document

- id-MLDSA87-Ed448
Expand Down Expand Up @@ -1439,6 +1449,11 @@ EDNOTE to IANA: OIDs will need to be replaced in both the ASN.1 module and in {{
- Description: id-HashMLDSA65-RSA4096-PKCS15-SHA512
- References: This Document

- id-HashMLDSA65-ECDSA-P256-SHA512
- Decimal: IANA Assigned
- Description: id-HashMLDSA65-ECDSA-P256-SHA512
- References: This Document

- id-HashMLDSA65-ECDSA-P384-SHA512
- Decimal: IANA Assigned
- Description: id-HashMLDSA65-ECDSA-P384-SHA512
Expand Down
Loading