Subject: [Cfrg] RGLC on draft-irtf-cfrg-xmss-hash-based-signatures-03.txt

From: Alexey Melnikov <[email-masked]>
Date: Wed, 16 Mar 2016 19:45:38 +0000

This message starts 4 weeks RGLC on
draft-irtf-cfrg-xmss-hash-based-signatures-03.txt (XMSS: Extended
Hash-Based Signatures) which will end on April 13th. Please let chairs
know if you think the document is ready for IRSG review (and publication
as an RFC) or if you find any issues with it.

Best Regards,
Kenny and Alexey

---

From: Gilles Van Assche <[email-masked]>
Date: Fri, 18 Mar 2016 17:36:59 +0100

Dear all,

As obvious as it may sound from a co-designer of Keccak, I nevertheless
think that the proposed scheme should also support FIPS 202 instances.

The same comment goes for draft-mcgrew-hash-sigs and, in general, new
proposals from the CFRG. Modern schemes should use modern hash standards.

Kind regards,
Gilles

On 16/03/16 20:45, Alexey Melnikov wrote:
> _______________________________________________
> Cfrg mailing list
> [email-masked]
> https://www.irtf.org/mailman/listinfo/cfrg
>

---

From: Russ Housley <[email-masked]>
Date: Fri, 18 Mar 2016 14:19:44 -0400

The SHA-2 family of hash functions and the SHA-3 family of hash functions have the same security.  They do not have the same performance in many computing environments, so I do not think it is appropriate to exclusively require the SHA-3 family of hash functions.

Russ

---

From: "A. Huelsing" <[email-masked]>
Date: Mon, 21 Mar 2016 11:41:59 +0100

Our reasoning behind choosing SHA2 for the first parameter sets was
based on the availability of implementations in the field.
However, this selection is not exclusive! We even describe in the
document what has to be done to define parameter sets
based on other hash functions / block ciphers.

I think it is a question for cfrg if we want to include parameters based
on different hash functions in this state. I guess we can easily
include SHA3 parameters as optional if someone provides us with a
section describing how the different function families are instantiated
using SHA3.

Andreas

---

From: "Grigory Marshalko" <[email-masked]>
Date: Tue, 22 Mar 2016 19:09:02 +0000

I think a good approach for the first step is to use hash/block cipher algos that are already described in informational RFCs: as for hashes, say, SHA-2 family, Blake2, Streebog etc. It is rather convenient, since implementors could have a reasonable choice from the beginning and all descriptions could be found at the same place, written in the same manner. 
Regards,
Grigory Marshalko,
expert,
Technical committee for standardisation "Cryptography and security mechanisms" (TC 26)
www.tc26.ru

21 марта 2016 г., 13:42, "A. Huelsing" <[email-masked]> написал:
>> The SHA-2 family of hash functions and the SHA-3 family of hash functions have the same security.
>> They do not have the same performance in many computing environments, so I do not think it is
>> appropriate to exclusively require the SHA-3 family of hash functions.
>> 
>> Russ
>>