Subject: [Cfrg] Fwd: Request for comments on GOST documents

From: David McGrew <[email-masked]>
Date: Wed, 2 Sep 2009 11:19:27 -0700

Forwarding for Bob Braden (because the CFRG mail list didn't forward  
his message).

Begin forwarded message:
> -------- Original Message --------
> Subject: 	[RFC-Ed-Board] Request for comments on GOST documents
> Date: 	Wed, 26 Aug 2009 09:35:11 -0700
> From: 	Bob Braden <[email-masked]>
> To: 	[email-masked]
> CC: 	[email-masked] <[email-masked]>, RFC
> Editor <[email-masked]>
>
>
>
> To the CFRG:
>
> The RFC Independent Submission Editor has received three documents
> dealing with the GOST cryptographic algorithms:
>
> 	draft-dolmatov-cryptocom-gost34102001-03.txt
> 	draft-dolmatov-cryptocom-gost341194-01.txt
> 	draft-dolmatov-cryptocom-gost2814789-01.txt
>
> We are soliciting reviews and comments on these documents.   
> Specifically
> we are looking for expert input on their completeness and clarity.
>
> Based on some of the comments on the CFRG mailing list, the RFC
> Editorial Board is considering the need for a commentary RFC to be
> published at the same time, discussing security flaws or weaknesses of
> the GOST algorithms. If you have an interest in writing such a  
> document,
> or have input for such a document, please let us know.  Jim Schaad has
> indicated a willingness to be lead author.
>
> We appreciate yoiur help in this effort!
>
> Independent Submissions Editor/bb
>
> _______________________________________________
> RFC-Ed-Board mailing list
> [email-masked]
> http://rfc-editor.org/mailman/listinfo/rfc-ed-board
>
>

---

From: Paul Hoffman <[email-masked]>
Date: Wed, 2 Sep 2009 16:16:34 -0700

>the GOST algorithms. If you have an interest in writing such a document,

I think the "some comments" was two comments pointing to cryptographic research showing weaknesses in the hash algorithm. One person pointed to some papers, and another (one of the authors on the papers) summarized the contents as:

  To cut a long story short: We looked at the alleged GOST hash (using
  a unofficial translations and help from people knowing Russian), and
  found both collision and preimage attacks, suggesting that the GOST
  hash function is less secure than one would expect from a "good" hash
  function.

  Note that none of the attacks we propose is practical. Still, no such
  attacks are known on any of the SHA-2 hash functions.

If the "some comments" is limited to that, it might be better to just ask the author to add those pointers to the Security Considerations section of the hash algorithm document. That would be a lot less work for Jim, and would have the advantage of not forcing the reader to find an additional RFC when looking at the specs.

--Paul Hoffman, Director
--VPN Consortium