Subject: [acvp] A strategy for IETF-ing our specs

From: "Vassilev, Apostol (Fed)" <[email-masked]>
Date: Fri, 7 Sep 2018 20:31:48 +0000

I have been thinking about a strategy for positioning the ACVP and the algorithm test specifications within IETF.

One of the objectives for going to the IETF is that we want to have standard mechanisms for automated testing of cryptographic algorithm implementations. 

However, at this stage, there is nothing that binds the ACVP protocol specified in draft-fussell-acvp-spec-00 (see https://github.com/usnistgov/ACVP) to the algorithm test specifications, e.g., draft-celi-block-ciph-00 or to the extension document draft-vassilev-acvp-ext-00. They are related to each other only because they are collocated in the same repository. This is not satisfactory for achieving the stated  objective.

To bind them properly we should think about each algorithm test specification, currently available and new to be developed in the future, as extensions to the ACVP protocol. There will be a new IANA registry for the supported algorithm extensions. For example, this registry would contain a table that links the taxonomy of algorithms listed in draft-vassilev-acvp-ext-00 to each algorithm test specification, e.g. draft-celi-block-ciph-00. Then the protocol spec, in section IANA Considerations, would list the specific IANA registrations for the algorithm test specifications that it currently supports. In addition, IANA offers protocols for managing registrations which would provide us with a robust mechanism for managing the ACVP extensions as we add algorithms beyond those approved by NIST.    

I recommend checking RFC 8126 for information on IANA registries.   

This means that we would need to rework the three initial specifications first, the rest of the algorithm test specifications later, along these lines. It seems to me that we may have to break up the block cipher spec into individual specs for each individual algorithm/mode, which would have its own IANA registration. It may also mean that each algorithm spec may have to elaborate on the basic flows for registration and testing with ACVP. Currently, these flows are kind of explained in the ACVP spec and the individual algorithm test specification only list a ton of properties one can use with these flows. This is not very transparent for the reader and may lead to confusion. Instead, each algorithm test spec should contain an explanation of the basic flows for ACVP: registration, requesting test data, submitting test results, etc, with specific examples. Right now, there are only examples in the appendices but there are no sections explaining them. 

Moreover, the extension specification in draft-vassilev-acvp-ext-00 would become the specification of the IANA registry for ACVP extensions. 

Lastly, the protocol spec in draft-fussell-acvp-spec-00 would reference the IANA extensions it supports in its section IANA Considerations.   

Please give it some thought and provide feedback.     

Thanks, 
Apostol

---

From: "Barry Fussell (bfussell)" <[email-masked]>
Date: Thu, 13 Sep 2018 19:53:49 +0000

I'm on board with this, will include IANA Considerations section in the protocol spec.

-----Original Message-----
From: Vassilev, Apostol (Fed) [mailto:[email-masked]] 
Sent: Friday, September 07, 2018 4:32 PM
To: [email-masked]; [email-masked]
Subject: [algotest] A strategy for IETF-ing our specs

Thanks, 
Apostol

-- 
You received this message because you are subscribed to the Google Groups "algotest" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [email-masked].
Visit this group at https://groups.google.com/a/list.nist.gov/group/algotest/.

---

From: "Vassilev, Apostol (Fed)" <[email-masked]>
Date: Thu, 13 Sep 2018 19:55:51 +0000

Thanks, Barry. Stay safe from Florence. 

Regards,
Apostol

> On Sep 13, 2018, at 2:53 PM, Barry Fussell (bfussell) <[email-masked]> wrote:
>