Subject: [Cfrg] Recent SM2 and SM3 drafts update

From: Sean Shen 沈烁 <[email-masked]>
Date: Wed, 19 Feb 2014 09:00:13 +0800

Dear cryptographers in CFRG,

I have been working on writing a few cryptographic algorithms documents: SM2
elliptic curve digital signature algorithm and SM3 hash function. The two
algorithms are published in China for years and required to be used in IT
systems like electronic authentication service system. 

It was my pleasure to provide the IETF documents to make these algorithms
public to IETF community and hence the whole Internet industry. The two
documents have been in published for quite a while and I updated a few
versions. I also have given presentations in IETF meetings a few times to
security guys in CFRG. Audience has been very interested in them. 

I think these works are valuable to both IETF community and vendors in
Chinese market. So I hope the two documents on the track to be IETF RFCs.

Also I prepared a simple webpage to give information (related documents and
implementations) of a few crypto algorithms used in China, including SM2 and
SM3. I will keep updating the draft and webpage , hope they are helpful to
the community. Please check:

http://218.241.108.63/wiki/en/index.php/Main_Page 

I will appreciate and reviews and suggestions.

Sean Shen

CNNIC

 

A new version of I-D, draft-shen-sm2-ecdsa-02.txt has been successfully
submitted by Sean Shen and posted to the IETF repository.

Name:               draft-shen-sm2-ecdsa

Revision:  02

Title:                  SM2 Digital Signature Algorithm

Document date:       2014-02-14

Group:               Individual Submission

Pages:               40

URL:            http://www.ietf.org/internet-drafts/draft-shen-sm2-ecdsa-02.
txt

Status:         https://datatracker.ietf.org/doc/draft-shen-sm2-ecdsa/

Htmlized:       http://tools.ietf.org/html/draft-shen-sm2-ecdsa-02

Diff:           http://www.ietf.org/rfcdiff?url2=draft-shen-sm2-ecdsa-02

Abstract:

   This document discribles a set of public key cryptographic algorithms

   based on elliptic curves which is invented by Xiaoyun Wang et al.

   These algorithms and recommended parameters are published by Chinese

   Commercial Cryptography Administration Office ([SM2 Algorithms] and

   [SM2 Algorithms Parameters]) for the use of electronic authentication

   service system.  This document gives IETF standard description of the

   algorithms and parameters in [SM2 Algorithms] and [SM2 Algorithms

   Parameters].

   The document [SM2 Algorithms] published by Chinese Commercial

   Cryptography Administration Office includes four parts: general

   introdocution, Digital Signature Algorithm, Key Exchange Protocol and

   Public Key Encryption Algorithm.

   The document [SM2 Algorithms Parameters] gives a set of recommended

   parameters.

A new version of I-D, draft-shen-sm3-hash-01.txt has been successfully
submitted by Sean Shen and posted to the IETF repository.

Name:               draft-shen-sm3-hash

Revision:  01

Title:                  SM3 Hash function

Document date:       2014-02-14

Group:               Individual Submission

Pages:               13

URL:
http://www.ietf.org/internet-drafts/draft-shen-sm3-hash-01.txt

Status:         https://datatracker.ietf.org/doc/draft-shen-sm3-hash/

Htmlized:       http://tools.ietf.org/html/draft-shen-sm3-hash-01

Diff:           http://www.ietf.org/rfcdiff?url2=draft-shen-sm3-hash-01

Abstract:

   This document discribles a hash function which is invented by Xiaoyun

   Wang et al.  This algorithm is published by Chinese Commercial

   Cryptography Administration Office ([SM3]) for the use of electronic

   authentication service system.  This document gives IETF standard

   description of the algorithm.

---

From: Watson Ladd <[email-masked]>
Date: Tue, 18 Feb 2014 17:31:12 -0800

If this is a valid transcription of the standard, it should be fine.
But the place you want to go is the IPSEC and TLS WGs to get it into
implementations.

Note that this is not a recommendation for usage: I haven't validated
parameters or the algorithms, and SM3 in particular looks sketchy.
(It's an MD-style hash, in a world where many have fallen). Has there
been a lot of analytical attention devoted to it that I've missed
hearing about?

Sincerely,
Watson Ladd

On Tue, Feb 18, 2014 at 5:00 PM, Sean Shen 沈烁 <[email-masked]> wrote:
> http://www.ietf.org/internet-drafts/draft-shen-sm2-ecdsa-02.txt
>
> _______________________________________________
> Cfrg mailing list
> [email-masked]
> http://www.irtf.org/mailman/listinfo/cfrg
>

-- 
"Those who would give up Essential Liberty to purchase a little
Temporary Safety deserve neither  Liberty nor Safety."
-- Benjamin Franklin

---

From: Paul Lambert <[email-masked]>
Date: Tue, 18 Feb 2014 17:41:36 -0800

Hi Shen,

Very interesting work.  It is good to see more curves appearing.  Thank you very much for publishing.  A couple small questions.

Is there a licensing statement associated with the submittal?
http://www.google.com/patents/CN102104481A?cl=en

When you say public below, I assume this statement means the work is being placed into the public domain.
Yes?

Thanks in advance,

Paul

From: Cfrg [mailto:[email-masked]] On Behalf Of Sean Shen ??
Sent: Tuesday, February 18, 2014 5:00 PM
To: [email-masked]
Subject: [Cfrg] Recent SM2 and SM3 drafts update

Dear cryptographers in CFRG,
I have been working on writing a few cryptographic algorithms documents: SM2 elliptic curve digital signature algorithm and SM3 hash function. The two algorithms are published in China for years and required to be used in IT systems like electronic authentication service system.
It was my pleasure to provide the IETF documents to make these algorithms public to IETF community and hence the whole Internet industry. The two documents have been in published for quite a while and I updated a few versions. I also have given presentations in IETF meetings a few times to security guys in CFRG. Audience has been very interested in them.
I think these works are valuable to both IETF community and vendors in Chinese market. So I hope the two documents on the track to be IETF RFCs.
Also I prepared a simple webpage to give information (related documents and implementations) of a few crypto algorithms used in China, including SM2 and SM3. I will keep updating the draft and webpage , hope they are helpful to the community. Please check:
http://218.241.108.63/wiki/en/index.php/Main_Page
I will appreciate and reviews and suggestions.

Sean Shen
CNNIC

A new version of I-D, draft-shen-sm2-ecdsa-02.txt has been successfully submitted by Sean Shen and posted to the IETF repository.

Revision:  02

Pages:               40

URL:            http://www.ietf.org/internet-drafts/draft-shen-sm2-ecdsa-02.txt

Abstract:

   Parameters].

   parameters.

A new version of I-D, draft-shen-sm3-hash-01.txt has been successfully submitted by Sean Shen and posted to the IETF repository.

Revision:  01

Title:                  SM3 Hash function

Pages:               13

URL:            http://www.ietf.org/internet-drafts/draft-shen-sm3-hash-01.txt

Abstract:

---

From: Stephen Farrell <[email-masked]>
Date: Wed, 19 Feb 2014 01:44:05 +0000

> But the place you want to go is the IPSEC and TLS WGs to get it into

Not yet perhaps. I figure there's value in some more crypto clue
validating that the text of the drafts looks fine since they're
not simple transcriptions and e.g. maybe some more test vectors
or something might be suggested and added. At that point shooting
these via the independent submission stream is the usual thing
and after that it'd be time to head to TLS or IPSECME.

> been a lot of analytical attention devoted to it that I've missed

Right. Those are the things it'd be great to have seen
informed comment on here.

S

---

From: Sean Shen 沈烁 <[email-masked]>
Date: Wed, 19 Feb 2014 10:36:13 +0800

These are the documents describing algorithms themselves, trying to stick to the original standards. I discussed with the security directors, they also think CFRG is the proper place for algorithms regarding clarity and correctness of the text.
As for implementations, hope the algorithms will be options for applications, IPSEC and TLS definitely are definitely widely used ones, maybe also DNSSEC although DNSEXT WG is concluded currently. So far I haven't discussed with guys in those area regarding adopting SM2 and SM3 in those application, I plan to have the algorithms documents ready for the IETF reference first. 

Regarding the SM3 Hash function. It is based on the Merkle-Damgård design and very similar to SHA-2 but includes some additional strengthening features, it was designed by Xiaoyun Wang et al. I am not the designer and did not crypto analysis myself, but I collected some related arypto analysis paper in the webpage I mentioned, you can especially check: http://218.241.108.63/wiki/en/index.php/SM3%27s_related_papers   

-----邮件原件-----
发件人: Watson Ladd [mailto:[email-masked]] 
发送时间: 2014年2月19日 9:31
收件人: Sean Shen 沈烁
抄送: [email-masked]
主题: Re: [Cfrg] Recent SM2 and SM3 drafts update

If this is a valid transcription of the standard, it should be fine.
But the place you want to go is the IPSEC and TLS WGs to get it into implementations.

Note that this is not a recommendation for usage: I haven't validated parameters or the algorithms, and SM3 in particular looks sketchy.
(It's an MD-style hash, in a world where many have fallen). Has there been a lot of analytical attention devoted to it that I've missed hearing about?

Sincerely,
Watson Ladd

On Tue, Feb 18, 2014 at 5:00 PM, Sean Shen 沈烁 <[email-masked]> wrote:
> I have been working on writing a few cryptographic algorithms 
> documents: SM2 elliptic curve digital signature algorithm and SM3 hash 
> function. The two algorithms are published in China for years and 
> required to be used in IT systems like electronic authentication service system.
>
> It was my pleasure to provide the IETF documents to make these 
> algorithms public to IETF community and hence the whole Internet 
> industry. The two documents have been in published for quite a while 
> and I updated a few versions. I also have given presentations in IETF 
> meetings a few times to security guys in CFRG. Audience has been very interested in them.
>
> implementations) of a few crypto algorithms used in China, including 
> SM2 and SM3. I will keep updating the draft and webpage , hope they 
> are helpful to the community. Please check:
>
> A new version of I-D, draft-shen-sm2-ecdsa-02.txt has been 
> successfully submitted by Sean Shen and posted to the IETF repository.
>
>
>

--
"Those who would give up Essential Liberty to purchase a little Temporary Safety deserve neither  Liberty nor Safety."
-- Benjamin Franklin

---

From: "Blumenthal, Uri - 0558 - MITLL" <[email-masked]>
Date: Wed, 19 Feb 2014 08:07:28 -0500

Sean,

Are there (free :) reference implementations available?

TNX!

P.S. I wonder why China and Russia went with their own ECC digital signature standards rather than embracing ECDSA :).
--
Regards,
Uri Blumenthal                            Voice: (781) 981-1638
Cyber Systems and Technology   Fax:   (781) 981-0186
MIT Lincoln Laboratory                Cell:  (339) 223-5363
244 Wood Street                        Email: <[email-masked]>
Lexington, MA  02420-9185       

Web:  http://www.ll.mit.edu/CST/

MIT LL Root CA: 

 <https://www.ll.mit.edu/labcertificateauthority.html>

DSN:   478-5980 ask Lincoln ext.1638

-----邮件原件-----
发件人: Watson Ladd [mailto:[email-masked]] 
发送时间: 2014年2月19日 9:31
收件人: Sean Shen 沈烁
抄送: [email-masked]
主题: Re: [Cfrg] Recent SM2 and SM3 drafts update

Sincerely,
Watson Ladd

---

From: David McGrew <[email-masked]>
Date: Wed, 19 Feb 2014 17:48:29 -0500

Hi Sean,

> These are the documents describing algorithms themselves, trying to stick to the original standards. I discussed with the security directors, they also think CFRG is the proper place for algorithms…

I agree with you and the ADs.   CFRG is the best place to have these 
documents reviewed.

CFRG people should keep in mind that these docs are informational, and 
that they aim to describe how to implement algorithms that are specified 
in other documents.   Comments and questions that would improve the 
clarity of description are helpful; comments on design alternatives are 
not.   Outside of the normative text, it might be possible for people to 
suggest useful informative text, on security considerations or 
implementation techniques, say.   It would also be good if we can 
establish interoperability between independent implementations.

Anyone willing to volunteer to review the docs, or to check test cases?

thanks,

David

---

From: Sean Shen 沈烁 <[email-masked]>
Date: Thu, 20 Feb 2014 11:45:04 +0800

hi, Uri

> Are there (free :) reference implementations available?
Yes, there are free implementations, please check the infor web I included in the email:
http://218.241.108.63/wiki/en/index.php/Main_Page 
There is a "software implementation" link on the left. 

> 
> TNX!
> 
> P.S. I wonder why China and Russia went with their own ECC digital signature
> standards rather than embracing ECDSA :).

Well, it's common for countries to adopt both internationally widely used algorithms and their own algorithms. It happened in many countries and various technique areas. I tend to have these algorithms open to the community for both studying and commercial convenience. 

Best,

Sean

---

From: Joachim Strömbergson <[email-masked]>
Date: Thu, 20 Feb 2014 08:42:03 +0100

Aloha!

Sean Shen 沈烁 wrote:
> http://218.241.108.63/wiki/en/index.php/Main_Page There is a
> "software implementation" link on the left.

You might want to look into the naming of the directory that has been
zipped:

http://218.241.108.63/wiki/en/index.php/File:Sm2_sm3_sm4_c_language_open_source_code.zip

It unzips to something quite incomprehensible.

The files does not contain any copyright or licensing statements and no
other information about it is given. Can you please add that?

I may be interested at implementing at least sm3 (I have previously
looked at ZUC), but will not do that unless I know the licensing and IPR
status.

- -- 
Med vänlig hälsning, Yours

Joachim Strömbergson - Alltid i harmonisk svängning.
========================================================================

---

From: "Blumenthal, Uri - 0558 - MITLL" <[email-masked]>
Date: Thu, 20 Feb 2014 11:39:13 -0500

>There is a "software implementation" link on the left.

Nice! 

Unfortunately, quite a few things - including directory name in at least
one case - are in Chinese (literally :). Since unfortunately I don't
speak/read Chinese, it adds unnecessary difficulties. Suggestion: edit it
so they are entirely in English, preferably using ASCII.

Also, I'd like to second the question that Joachim asked earlier: what are
the Copyright and Intellectual Property statements for this code, and for
these algorithms? Who owns them, and who does the owner allow usage of
those algorithms (and of that code)? On what conditions (if any are
stated)?

Also, I'm interested in the SM2 suite, especially its Authenticated Key
Exchange part. Us there (a) a complete description in English, and (b)
source code available for it? There was a paper at CANS 2011 "Comments on
SM2 Key Exchange" that pointed out a weakness, and suggested a fix for it.
Can you tell whether that suggestion has been incorporated in the current
SM2 key exchange standard?

Again, to repeat myself and echo Joachim: in order to do anything with
these algorithms (even to look at them) we need to know their
licensing/IPR and copyright status.

Thanks!

---

From: Sean Shen 沈烁 <[email-masked]>
Date: Sat, 22 Feb 2014 13:18:35 +0800

hi, Uri

> so they are entirely in English, preferably using ASCII.

Thanks for the suggestions. I checked the codes, one of them has a Chinese word in direction name, 3 of them have Chinese comments in the codes, only one code is in pure English. 
Here is what I will do: since I am not the author of the codes, probably not proper for me to change the codes. I will have the Chinese translated and provide the pure English versions for download beside the original ones, also provide a note on the download page and stating the situation. 
This will be done before Monday afternoon (Beijing time). 

Here are the details:
________________________________________________
1. 
c language open source codes:SM2,SM3,SM4
http://218.241.108.63/wiki/en/index.php/File:Sm2_sm3_sm4_c_language_open_source_code.zip

There is a Chinese word in Dictionary. I will replace it by English.

2. 
Java language:ECC
http://218.241.108.63/wiki/en/index.php/File:Java_ecc_code.zip

There are Chinese comments in the codes. I will translate it in English.

3. 
openssl language:SM2
http://218.241.108.63/wiki/en/index.php/File:SM2-Openssl_language.zip

No langusage problems

4. 
Java language:SM3
http://218.241.108.63/wiki/en/index.php/File:Sm3-Java.zip

There are a lot Chinese comments in the codes. I will translate it in English.

5. 
Java language:SM4
http://218.241.108.63/wiki/en/index.php/File:Sm4-Java.zip

There are a few Chinese comments in the codes. I will translate it in English.
____________________________________________________________________

> those algorithms (and of that code)? On what conditions (if any are

Good questions.
As for the algorithms, here is what I am aware of: 
There is patent (or patents) with the algorithms. But when the algorithms were adopted by TCG (Trusted Computing Group) in TPM 2.0 standards, the owners announced these patents free in TCG. I contacted the owners and they are discussing to give statement here following IETF's rules. I will keep updating it for all, on both my web and ietf mailing list.
As for the codes, they were collected on the internet, some from programmers' community or from course projects, by people who are interested in this area or students who did course project. These are just for simple testing of the algorithms. If I need codes for my serious purpose (commercial or non-commercial), I would prefer commercial development work or our own development, it's not a lot work after all.   
Authors of these codes didn't left information regarding copyright or license, I am contacting the authors of the codes via limited contact information in codes, if I am lucky to get in touched with them, they might give more information.    
Also CCed and thanks Joachim for his attention. I try to put similar answers in this single reply so that I won't miss any if the thread goes long. 

> SM2 key exchange standard?

Thanks for this information. To answer that I will finish reading the paper and give clear feedback. I will give feedbacks soon following Watson's thread.   
Thanks!

Sean

---

From: Sean Shen 沈烁 <[email-masked]>
Date: Sun, 23 Feb 2014 17:04:32 +0800

the pure English versions is ready on the web by now. 

> > Unfortunately, quite a few things - including directory name in at
> > least one case - are in Chinese (literally :). Since unfortunately I
> > don't speak/read Chinese, it adds unnecessary difficulties.
> > Suggestion: edit it so they are entirely in English, preferably using
ASCII.
> 
> Thanks for the suggestions. I checked the codes, one of them has a Chinese
> word in direction name, 3 of them have Chinese comments in the codes, only
> one code is in pure English.
> Here is what I will do: since I am not the author of the codes, probably
not
> proper for me to change the codes. I will have the Chinese translated and
> provide the pure English versions for download beside the original ones,
also
> provide a note on the download page and stating the situation.

---

From: Paul Lambert <[email-masked]>
Date: Sun, 23 Feb 2014 23:53:31 -0800

Sean,

There’s a small error in http://www.ietf.org/id/draft-shen-sm2-ecdsa-02.txt in section A.1

The encoding:
    '414C 49434531 32334059 41484F4F 2E434F4’
should be:
    '414C 49434531 32334059 41484F4F 2E434F4D’   <- D at end of string

Also – is there any accompanying documentation on the process for selecting the curve parameters?

Best Regards,

Paul

From: Cfrg [mailto:[email-masked]] On Behalf Of Sean Shen ??
Sent: Tuesday, February 18, 2014 5:00 PM
To: [email-masked]<mailto:[email-masked]>
Subject: [Cfrg] Recent SM2 and SM3 drafts update

Sean Shen
CNNIC

Revision:  02

Pages:               40

Abstract:

   Parameters].

   parameters.

Revision:  01

Title:                  SM3 Hash function

Pages:               13

Abstract: