Subject: Re: [Cfrg] IBE checking...

From: Stephen Farrell <[email-masked]>
Date: Mon, 21 Mar 2016 14:46:46 +0000

Closing a long-open loop...

On 17/11/14 15:56, Stephen Farrell wrote:
> 
> Hiya,
> 
> This IBE draft [1] is on next week's IESG telechat. Since
> IBE ain't my thang really, I figured I'd check see if
> someone here wanted to give it a read from a crypto POV.
> 
> There's not too much to this over and above RFC6507 [2] (I
> think:-) but this seems to be the first case of a standards
> track document making use of 6507 so there's a bit of process
> novelty here, even if not much cryptographic novelty.
> 
> If you can review, sending comments here, or to the secdir
> list, or the IETF list or just to Kathleen and I are all fine
> things to do. If you might get to it but aren't sure please
> drop me a note.
> 
> Oh, and it's not that long: just 16 pages incl. examples:-)

I held a DISCUSS on this since November 2014. The resolution of
that was to change the draft to aim for an experimental RFC
mainly on the basis that the crypto didn't have any published
analyses. So I've moved to an ABSTAIN position (you can see
my comments in the tracker if you go to [3] below).

While I'm not a fan of IBE myself, and there's still no published
analyses, I don't think we can block experimental stuff for those
reasons alone. (Otherwise CFRG might have a hard time producing
some new experimental specs for example.) Mind you, that does
assume that the rest of the world know the difference between
experimental and standards-track RFCs, which is not actually
true, but we do also need to stick with the rules of the game
that we've setup so I think this is the correct, if not the
optimal, outcome.

This may still come back to the IESG for another evaluation
as the IESG personnel turnover in the meantime means it needs
some more ballots, so if there's any new information that'd
be relevant, I'd still be interested in hearing about that.

Thanks,
S.

> 
> Thanks in advance,
> S.
> 
> [1] https://datatracker.ietf.org/doc/draft-ietf-manet-ibs/
> [2] https://tools.ietf.org/html/rfc6507

[3]
https://datatracker.ietf.org/doc/draft-ietf-manet-ibs/ballot/#stephen-farrell

> 
> _______________________________________________
> Cfrg mailing list
> [email-masked]
> http://www.irtf.org/mailman/listinfo/cfrg
> 
>

---

From: Tanja Lange <[email-masked]>
Date: Mon, 21 Mar 2016 16:09:40 +0100

Dear Stephen, dear all,
> that we've setup so I think this is the correct, if not the
There is ongoing work on breaking the discrete log problem in the
target group (the group where the pairing maps to). The most 
recent publication I'm aware of is
	https://eprint.iacr.org/2015/1027

At ECC 2015 Aurore Guillevic gave a talk
Computing individual discrete logarithms faster in F_{p^n} with the Number Field Sieve algorithm
in which she is targeting fields with 1<=n<=12, which are exactly the
fields appearing as targets of pairings. For abstract and slides see
	http://ecc2015.math.u-bordeaux1.fr/index.php?category=conference&page=programme
So, at this moment I'd suggest some caution for parameter suggestions.

All the best
	Tanja

---

From: "Paterson, Kenny" <[email-masked]>
Date: Mon, 21 Mar 2016 17:09:37 +0000

Hi

From the specification, it's pretty clear that this proposal does not use
pairings:

>In common
>with other identity-based encryption/signature approaches, it is
>based on the use of elliptic curves.  Unlike some, it does not use
>"pairings" (bilinear maps from a product of two elliptic curve groups
>to another group).

So the recent analysis in eprint 2015/1027 is not relevant here.

Cheers

Kenny

On 21/03/2016 15:09, "Cfrg on behalf of Tanja Lange"
<[email-masked] on behalf of [email-masked]> wrote:

>https://www.irtf.org/mailman/listinfo/cfrg