Skip to content

Commit

Permalink
Update draft-ietf-lamps-pq-composite-sigs.md
Browse files Browse the repository at this point in the history
Add definition of new Signature methods
  • Loading branch information
johngray-dev authored Nov 25, 2024
1 parent bd4d0ed commit 87c0781
Showing 1 changed file with 15 additions and 11 deletions.
26 changes: 15 additions & 11 deletions draft-ietf-lamps-pq-composite-sigs.md
Original file line number Diff line number Diff line change
Expand Up @@ -164,23 +164,15 @@ This document defines combinations of ML-DSA [FIPS.204] in hybrid with tradition
--- middle


# Changes in -03
# Changes in -04

Interop-affecting changes:

* Compacted CompositeSignaturePrivateKey to SEQUENCE SIZE (2) OF OCTET STRING instead of OneAsymmetricKey to remove redundancy
* Added support for the ML-DSA context String, and use the Composite Domain as the context for the underlying ML-DSA component algorithm.
* Added Pre-Hash and Pure modes and changed the Message format to align with FIPS-204. This breaks backwards compatibility with all previous versions.
* Updated the OID table for new Pre-Hash OIDs and added them to the IANA section.
* Updated Use in CMS section to reflect content is hashed and pure Composite ML-DSA should be used.
* Removed the ASN.1 around the DER encoding

Editorial changes:

* Added the ASN.1 encodings for the component public keys and signature algorithm identifiers
* ASN.1 Module changes:
* Renamed the module from Composite-Signatures-2023 -> Composite-MLDSA-2024
* Simplified the ASN.1 module to make it more compiler-friendly (thanks Carl!) -- should not affect wire encodings.
* Updated Security Considerations about Non-separability, EUF-CMA and key reuse.



# Introduction {#sec-intro}
Expand Down Expand Up @@ -261,6 +253,18 @@ Composite schemes are defined as cryptographic primitives that consist of three
of the Message. If the signature and public key cannot verify the Message,
it returns false.

We define the following algorithms which we use to serialize and deserialize the public and private keys

* `SerializeKey(key) -> bytes`: Produce a fixed-length byte string encoding the public or private key.

* `DeserializeKey(bytes) -> pk`: Parse a fixed-length byte string to recover a public or private key. This function can fail if the input byte string is malformed.

We define the following algorithms which are used to serialize and deseralize the compsoite signature value

* `SerializeSignature(key) -> bytes`: Produce a fixed-length byte string encoding the public or private key.

* `DeserializeKey(bytes) -> pk`: Parse a fixed-length byte string to recover a public or private key. This function can fail if the input byte string is malformed.

A composite signature allows the security properties of the two underlying algorithms to be combined via standard signature operations `Sign()` and `Verify()`.

This specification uses the Post-Quantum signature scheme ML-DSA as specified in [FIPS.204] and {{I-D.ietf-lamps-dilithium-certificates}}. For Traditional signature schemes, this document uses the RSA PKCS#1v1.5 and RSA-PSS algorithms defined in [RFC8017], the Elliptic Curve Digital Signature Algorithm ECDSA scheme defined in section 6 of [FIPS.186-5], and Ed25519 / Ed448 which are defined in [RFC8410]. A simple "signature combiner"function which prepends a domain separator value specific to the composite algorithm is used to bind the two component signatures to the composite algorithm and achieve weak non-separablity.
Expand Down

0 comments on commit 87c0781

Please sign in to comment.