<html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head><body dir="auto">Thank you - and it’s great to see that 100% PQ Key Exchange is working with the existing code (I assume - based on liboqs?). <div><br></div><div>But generating signature is not acceptable in my use case, which is why we settled on a KEMTLS-like approach. Or, conceptually, like MQV/HMQV. Authenticating the peer implicitly by having its long-term (certified) public key participating in the Key Exchange. <div><br></div><div>I fully realize that the current TLS-1.3 does not support this kind of Key Exchange. Which is fine, because we’re not using TLS. :-)</div><div><br></div><div>Thanks<br><br><div dir="ltr">Regards,<div>Uri</div></div><div dir="ltr"><br><blockquote type="cite">On Oct 3, 2022, at 17:02, Mark Hack <markhack@markhack.com> wrote:<br><br></blockquote></div><blockquote type="cite"><div dir="ltr">
<meta http-equiv="Content-Type" content="text/html; charset=utf-8"><meta name="Generator" content="Microsoft Word 15 (filtered medium)"><style>@font-face { font-family: "Cambria Math"; }
@font-face { font-family: Calibri; }
@font-face { font-family: "Andale Mono"; }
p.MsoNormal, li.MsoNormal, div.MsoNormal { margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif; }
span.EmailStyle17 { font-family: Calibri, sans-serif; color: windowtext; }
.MsoChpDefault { font-family: Calibri, sans-serif; }
@page WordSection1 { size: 8.5in 11in; margin: 1in; }
div.WordSection1 { page: WordSection1; }</style><div>In this case you need to look at certificate / signature generation separately from the key exchange. In classical terms, I can have anRSA key with a RSA-SHA256 signature and use DHE elliptic curves to exchange a secret without knowing the elliptic curve public private key pair.</div><div><br></div><div>For example to use Dilthium public/private keys and a Dilithium signature , you can use the following to generate a csr ( or self sign):</div><div><br></div><div>openssl req -new -newkey dilithium2 -keyout qsc.key -config openssl.cnf -nodes </div><div><br></div><div><br></div><div>After you have the signed certificate, TLS uses that certificate but specifies Kyber for the key exchanges.</div><div><br></div><div>I self signed a dilithium certificate and started a server using:</div><div>openssl s_server -cert dilithium.crt -key dilithium.key -groups kyber768 </div><div><br></div><div><br></div><div>Then connected with a client using:</div><div>openssl s_client -connect 127.0.0.1:4433 -groups kyber768</div><div><br></div><div>This return a good connection:</div><div><br></div><div>No client certificate CA names sent</div><div><b>Peer signature type: Dilithium2</b></div><div><b>Server Temp Key: kyber768</b></div><div>---</div><div>SSL handshake has read 7911 bytes and written 1589 bytes</div><div>Verification error: self signed certificate</div><div>---</div><div>New, TLSv1.3, Cipher is TLS_AES_256_GCM_SHA384</div><div><b>Server public key is 10496 bit</b></div><div><br></div><div><br></div><div>Regards</div><div>Mark Hack</div><div><br></div><div><br></div><div><br></div><div>On Mon, 2022-10-03 at 15:11 +0000, Blumenthal, Uri - 0553 - MITLL wrote:</div><blockquote type="cite" style="margin:0 0 0 .8ex; border-left:2px #729fcf solid;padding-left:1ex"><div class="WordSection1"><p class="MsoNormal"><span style="font-size:12.0pt">TLDR; <o:p></o:p></span></p><p class="MsoNormal"><span style="font-size:12.0pt">Need to create a CSR for a key pair whose algorithm does not allow signing (either because it’s something like Kyber, or because restriction enforced by HSM). How to do it?<o:p></o:p></span></p><p class="MsoNormal"><span style="font-size:12.0pt"><o:p> </o:p></span></p><p class="MsoNormal"><span style="font-size:12.0pt">There are several use cases that require certifying long-term asymmetric keys that are only capable of encryption/decryption – but not signing/verification. That could be either because the algorithm itself does not do signing, or because the private key is generated and kept in a secure hardware that enforces usage restriction.<o:p></o:p></span></p><p class="MsoNormal"><span style="font-size:12.0pt"><o:p> </o:p></span></p><p class="MsoNormal"><span style="font-size:12.0pt">CSR is supposed to be signed by the corresponding private key to prove possession. Obviously, it cannot be done with a key such as described above. How is this problem addressed in the real world? With AuthKEM and KEMTLS, how would these protocols get their certificates?<o:p></o:p></span></p><p class="MsoNormal"><span style="font-size:12.0pt"><o:p> </o:p></span></p><p class="MsoNormal"><span style="font-size:12.0pt">Thanks!<o:p></o:p></span></p><div><div><p class="MsoNormal"><span style="color:black">--</span><span style="font-size:12.0pt;color:black"><o:p></o:p></span></p><p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Andale Mono";color:black">V/R,</span><span style="font-size:12.0pt;color:black"><o:p></o:p></span></p><p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Andale Mono";color:black">Uri Blumenthal Voice: (781) 981-1638 </span><span style="font-size:12.0pt;color:black"><o:p></o:p></span></p><p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Andale Mono";color:black">Secure Resilient Systems and Technologies Cell: (339) 223-5363</span><span style="font-size:12.0pt;color:black"><o:p></o:p></span></p><p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Andale Mono";color:black">MIT Lincoln Laboratory </span><span style="font-size:12.0pt;color:black"><o:p></o:p></span></p><p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Andale Mono";color:black">244 Wood Street, Lexington, MA 02420-9108 </span><span style="font-size:12.0pt;color:black"><o:p></o:p></span></p><p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Andale Mono";color:black"> </span><span style="font-size:12.0pt;color:black"><o:p></o:p></span></p><p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Andale Mono";color:black">Web: <a href="https://www.ll.mit.edu/biographies/uri-blumenthal" title="https://www.ll.mit.edu/biographies/uri-blumenthal"><span style="color:#713C56">https://www.ll.mit.edu/biographies/uri-blumenthal</span></a></span><span style="font-size:12.0pt;color:black"><o:p></o:p></span></p><p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Andale Mono";color:black">Root CA: <a href="https://www.ll.mit.edu/llrca2.pem" title="https://www.ll.mit.edu/llrca2.pem"><span style="color:#713C56">https://www.ll.mit.edu/llrca2.pem</span></a></span><span style="font-size:12.0pt;color:black"><o:p></o:p></span></p><p class="MsoNormal"><span style="color:black"> </span><span style="font-size:12.0pt;color:black"><o:p></o:p></span></p><p class="MsoNormal"><i><span style="color:black">There are two ways to design a system. One is to make it so simple there are obviously no deficiencies.</span></i><span style="font-size:12.0pt;color:black"><o:p></o:p></span></p><p class="MsoNormal"><i><span style="color:black">The other is to make it so complex there are no obvious deficiencies.</span></i><span style="font-size:12.0pt;color:black"><o:p></o:p></span></p><p class="MsoNormal"><i><span style="color:black"> - C. A. R. Hoare</span></i><span style="font-size:12.0pt;color:black"><o:p></o:p></span></p></div></div><p class="MsoNormal"><o:p> </o:p></p></div>
</blockquote>
</div></blockquote></div></div></body></html>