Minutes of the May 6th Meeting

[johngray-dev]

Present: Mike Ounsworth, Daniel Van Geest, Markku-Juhani Saarinen, Alexander Railien, Jean-Pierre Fiset, Carl Wallace, Corey Bonnel, John Gray, Julien Prat, Joe Mandel, James Tung, Han KlauBner, Abel CH Chen, Christoph Wildfeuer, Petr Muzikant, Austin Lin

Agenda:

• Go over Action Items
• Updates from the group
• Composite signature question

Action Items from last month:

• John Gray will post the slides presented during the hackathon in the GitHub repository.
  • Done
• John Gray to fix up the private key formats in his implementation and generate .csv files against other providers
  • Will do next month
• Mike/Daniel to look at updating the link to the R5 HTML file.
  • Mike Ounsworth will work on updating this in the github automation
• Alexander will schedule a meeting with John Gray to discuss the CMP implementation in May - John to send email to Alex
  • Not Done. John to send an e-mail to Alex and setup a meeting
• Carl Wallace will add support for hash SLH DSA and look into the external MLDSA.
  • Not Done, Carl is looking at adding composite tests, but is going to wait for the next composite update
• Mike Ounsworth - Add the NIST ACVP server as a verifier. Code is C# and it is evolving
  • There is a half complete pull request - They only had the internal functions
  • Markku point us here for a python wrapper https://github.com/mjosaarinen/py-acvp-pqc

Discussions

• Alexander Railean - CMP test suite can run via docker. This will make it easier for people to test their CMP implementations against. See: https://github.com/siemens/cmp-test-suite
  • High level question - KEM certificates - What specific use-cases are their for KEM certificates other than KEM TLS?
    • CMS/SMIME - Really anything that uses enveloped data, broader than S/MIME. File encryption, etc
• Daniel Van Geest - Waiting for updated composite drafts - Felipe had implemented composite in OQS provider
  • Asked about Composite KEM - Mike Ounsworth has a composite KEM python implementation with complete JSON test vectors
  • Carl had composite KEM before - Carl will also update his implementation
  • Looks like there will be 3 composite KEM implementations to do testing with in the near future!
  • Daniel is adding a KEMRecipientInfo implementation into openSSL, will ask Victor about it
• Mike brought up the private key format and how to test with the automation
  • The python that updates the compatibility tables is here: https://github.com/IETF-Hackathon/pqc-certificates/blob/master/docs/compat_matrix_instructions.md
• Markku brought up the immanent release of FN-DSA-ipd. He has seen a copy of the document, it is waiting to be signed off. They may put on ipd on ACVP. There is a whole new problem (more complicated than seed verses expanded). Much of the internals have changed. The floating point stuff is now fixed stuff. Old Falcon had some variable length signatures, they fixed that. Specification for Falcon Key generation - NTRU invert - one of the trickiest bits... Key generation is much slower - comparable to RSA key generation. Signature is much shorter. https://github.com/pornin/c-fn-dsa/blob/main/fndsa.h
• John gave an update on the composite signature proposal to remove the pure mode composite and only use pre-hash version of the composite. It uses a message format of this form: M' := Prefix || Domain || len(ctx) || ctx || HashOID || PH(M) and the pure form of ML-DSA as a component. Given M' is between 108 to 364 bytes, it pretty much mitigates the need to use external mu for the underlying ML-DSA mode.
  • A couple questions from the group but it seems there isn't any objection

[johngray-dev]

We are adding more clarification into composite signatures to explain why the "pure mode composites" were removed. See: lamps-wg/draft-composite-sigs#177