Subject: [Cfrg] CFRG meeting at IETF 87

From: David McGrew <[email-masked]>
Date: Fri, 26 Jul 2013 17:50:08 -0400

Hi,

here is the agenda for our upcoming meeting; we are looking forward to
seeing you there.

David and Kevin

---

Crypto Forum Research Group at IETF 87
Monday, July 29, 2013
1510-1610  Afternoon Session II                    
Room: Tiergarten 1/2     

Agenda Bashing

Randomized Hashing (as described in NIST SP-800-106/107) - Quynh Dang

Updates on active drafts

 - OCB Mode of Operation, draft-irtf-cfrg-ocb-03

 - Dragonfly Key Exchange, draft-irtf-cfrg-dragonfly-01

 - Hash-Based Signatures, draft-mcgrew-hash-sigs-00

"Selection of Future Cryptographic Standards", Sheffer, Grieco, McGrew.
draft-mcgrew-standby-cipher-00

Discussion on other crypto work
  Salsa20 
  DTLS In Constrained Environments (DICE)
  CAESER

---

From: Rene Struik <[email-masked]>
Date: Fri, 26 Jul 2013 19:05:35 -0400

Hi Dan:

I just quickly revisited the "password to point" mapping for elliptic 
curves in draft-irtf-cfrg-dragonfly-01 (Section 3.2.1) and noticed a 
small error: the seed is recursively defined. Fortunately, this is easy 
to fix, as follows:

was:

    base = H(max(Alice,Bob) | min(Alice,Bob) | password | counter)
    seed = KDF-n(seed, "Dragonfly Hunting And Pecking")

suggested change:

    base = H(max(Alice,Bob) | min(Alice,Bob) | password | counter)
    seed = KDF-n(base, "Dragonfly Hunting And Pecking")

On a more general note, with the draft rev1 version, the found point Q 
is a function of the password itself and the presumed key sharing 
parties Alice and Bob. In other words, the password-derived generator of 
the curve "PE Element" is fixed throughout the lifetime of the pair 
(password, key sharing parties). With draft-harkins-tls-pwd-03, a 
similar procedure is proposed, but there a "salt" is mixed in as well. 
Just curious: why the difference? 
<http://tools.ietf.org/pdf/draft-harkins-tls-pwd-03.pdf>

Best regards, Rene

On 7/26/2013 5:50 PM, David McGrew wrote:
> _______________________________________________
> Cfrg mailing list
> [email-masked]
> http://www.irtf.org/mailman/listinfo/cfrg

-- 
email: [email-masked] | Skype: rstruik
cell: +1 (647) 867-5658 | US: +1 (415) 690-7363

---

From: David McGrew <[email-masked]>
Date: Mon, 29 Jul 2013 05:16:19 -0400

Here is the updated and more detailed agenda.

David and Kevin 

---

Agenda Bashing

Note Well

Randomized Hashing (NIST SP-800-106/107) - Dang

Quick updates on active drafts
   OCB Mode of Operation, draft-irtf-cfrg-ocb-03
   Dragonfly Key Exchange, draft-irtf-cfrg-dragonfly-01
   Hash-Based Signatures, draft-mcgrew-hash-sigs-00
   Ciphers in Use in the Internet draft-irtf-cfrg-cipher-catalog-01

SM2 Digital Signature Algorithm, draft-shen-sm2-ecdsa-01 – Shen, Lee

Selection of Future Cryptographic Standards,
draft-mcgrew-standby-cipher-00 – McGrew, Sheffer, Grieco

Discussion on other crypto work
   DTLS In Constrained Environments (DICE) BoF
   Salsa20 
   CAESER