-
Notifications
You must be signed in to change notification settings - Fork 99
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Extracting quantum-resistant keys and classical keys from a composite key. #474
Comments
Tagging @feventura for advice on separating classic from composite keys. Then a question to @maroueneboubakri : Are you saying that #372 is resolved then? Would you be willing to share there how to do that so it can be closed? |
@baentsch that works for hybrid keys, but seems not for composite keys, if that thread/PR is supposed to support both hubrid and composite then I need to double-check for potential bug ? |
I'm afraid so: The solution by @thb-sb in #372 pre-dates the integration of composite keys, so there may indeed by something fishy. That's why I tagged the author/contributor of composite sigs, @feventura to possibly also take a look. And while we're at it, maybe also tapping @praveksharma for ideas knowing his interest in composite keys, too. |
Hi @maroueneboubakri . Could you explain a bit more about what you are trying to accomplish by extracting the component keys? I have two conflicting opinions about whether an API to break a composite into pieces is a good idea: On the first side, the whole purpose of a composite is to treat the whole thing as a single key. If you start extracting the components and using them for cryptographic operations (sign, encrypt) outside of the composite, then that completely undermines the security properties of the composite. The Internet Draft is very clear to never re-use component keys. So in that regard, the API you ask for is quite dangerous and can be easily mis-used. On the other hand, I could see people wanting to extract the component keys to perform checking on them -- ex.: key size, modulus, checking for Debian Weak Keys style RNG problems, etc. And in that regard, such an API seems useful. @baentsch It's probably reasonable to have an API to split a composite public or private key into its parts, but we should probably put some strong wording in the oqs/openssl documentation that you open yourself up to downgrade attacks if a verifier or encrypter / decrypter is willing to use the same key both in a composite and by itself, so reuse of composite component keys is strongly discouraged. |
@ounsworth Thanks for the explanation ! |
Hello,
Given a composite key, is there any way to programmatically extract quantum-resistant keys and classical keys from a composite key the same way we do for hybrid key using
OQS_HYBRID_PKEY_PARAM_*
?It seems that the provider can do it when parsing an input key or certificate.
Br
Maro
The text was updated successfully, but these errors were encountered: