Minutes of the January 7th 2025 Hackathon Meeting

[johngray-dev]

In attendance: Jean-Pierre Fiset, Austin Lin, Abel C. H. Chen, Petr Muzikant, Daniel Van Geest, Christoph Wildfeuer, Alexander Ralien, Carl Wallace, David Hook, Hendrik Brockhaus, Markku-Juhani Saarinen, Corey Bonnell, Mike Ounsworth, John Gray

Discussions:

• Daniel - Working on adding a proposal with an Issue and Pull Request for adding private key testing. If anyone is interested let Daniel know. David Hook and John Gray interested in this work. At some point private key automated tests can be added as well.
• Alexander - Working on adding PQ algorithms tests to the CMP test suite. Alex found the open source Python implementations of FIPS 203, 204 and 205 that were created by Markku. See https://github.com/mjosaarinen/py-acvp-pqc
• Markku - ACVP test vectors have a bug with the context. Markku mentioned his open source python implementation also has a wrapper for C#.
• Mike Ounsworkth - Wanted to discuss about the cluster of LAMPS PQC drafts. Daniel is an author on most of them. Dithium (ML-DSA) and Kyber (ML-KEM) certificates drafts, then CMS version of each of those two, and finally the composite signatures and composite KEM drafts for (6 total). Mike sendta note to Russ Housley, a lot of PQC drafts have made progress since Dublin. Time urgency, want to get them out the door quickly. Any big open issues?

Dilithium Certificates Draft Discussion - see https://datatracker.ietf.org/doc/draft-ietf-lamps-dilithium-certificates/

• External Mu discussion, Dilithium drafts do not have Hash ML-DSA except for exceptional places in End-Entity certs
• David Hook mentioned that if you have a key using the ML-DSA OID, you can use it for HashML-DSA (for example to sign a CRL). However, if you have a key using HashML-DSA, you can't use it for pure ML-DSA. David was certain he saw this in the NIST CSOR, it is certainly allowed in the FIPS documents.
• Markku has a question about Dilithium Certs and the use of external Mu. Are we passing around the Mu? Answer is yes, section 7 in dilithium certs will be updated with this. Markku mentioned that support of the external mu has been added into the ACVP vectors. "Its one of the 4 interfaces"! You can FIPS certify external mu.
• Corey: Is external mu sufficient for all cases to warrant so support of HashML-DSA in this draft? Our group did not have consensus. JP Fiset mentioned the market should decide. These are intricate matters, and we are trying to craft one statement. This needs to be clarified. Some of these details would be better in the security concerns section.

SLH-DSA Discussion - see https://datatracker.ietf.org/doc/draft-ietf-lamps-x509-slhdsa/

• CRL Sign keyusage is only allowed in pure mode, not HashSLH-DSA mode (see section 6 on Key Usage Bits in the above draft).
• The same pre-hash issue exists in SLH-DSA, but no external mu is available. However if preHash mode could be done in exceptional circumstances for things like CRL signing a lot of complaints would go away. Corey will send a message to the list and submit a GitHub issue to try and get clarity around the issue.

Discussion on HPKE with composite:

• Mike discussed Chris Wood is looking at composite for HPKE. However, there are some wrinkles that need to be worked out. For example, he wants to use the code point defined for X-Wing and define an X-Wing like keygen in composite KEM, but still use the Composite KEM domain separator... that would likely bring up interoperability issues. The biggest issue is that the proposed HPKE keygen is not FIPS certifiable and it is hard to believe no one using HPKE would never need FIPS certification. Further discussions will take place and hopefully a resolution.