Subject: [Cfrg] I-D Action: draft-irtf-cfrg-randomness-improvements-07.txt

From: [email-masked]
Date: Sat, 07 Sep 2019 08:14:03 -0700

A New Internet-Draft is available from the on-line Internet-Drafts directories.
This draft is a work item of the Crypto Forum RG of the IRTF.

        Title           : Randomness Improvements for Security Protocols
        Authors         : Cas Cremers
                          Luke Garratt
                          Stanislav Smyshlyaev
                          Nick Sullivan
                          Christopher A. Wood
	Filename        : draft-irtf-cfrg-randomness-improvements-07.txt
	Pages           : 10
	Date            : 2019-09-07

Abstract:
   Randomness is a crucial ingredient for TLS and related security
   protocols.  Weak or predictable "cryptographically-strong"
   pseudorandom number generators (CSPRNGs) can be abused or exploited
   for malicious purposes.  The Dual EC random number backdoor and
   Debian bugs are relevant examples of this problem.  An initial
   entropy source that seeds a CSPRNG might be weak or broken as well,
   which can also lead to critical and systemic security problems.  This
   document describes a way for security protocol participants to
   augment their CSPRNGs using long-term private keys.  This improves
   randomness from broken or otherwise subverted CSPRNGs.

The IETF datatracker status page for this draft is:
https://datatracker.ietf.org/doc/draft-irtf-cfrg-randomness-improvements/

There are also htmlized versions available at:
https://tools.ietf.org/html/draft-irtf-cfrg-randomness-improvements-07
https://datatracker.ietf.org/doc/html/draft-irtf-cfrg-randomness-improvements-07

A diff from the previous version is available at:
https://www.ietf.org/rfcdiff?url2=draft-irtf-cfrg-randomness-improvements-07

Please note that it may take a couple of minutes from the time of submission
until the htmlized version and diff are available at tools.ietf.org.

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/

---

From: Björn Haase <[email-masked]>
Date: Sat, 7 Sep 2019 17:55:45 +0200

>          Title           : Randomness Improvements for Security Protocols

I support the idea of adding an independent random seed for protocols
where randomness is crucial. I also agree that the hashed key derivation
function approach (Expand-Exctract) is a conservative, yet possibly
somewhat costly and slow choice.

I had a couple of discussion with different cryptographers, specifically
considering the topic of side-channel resistance (e.g. with respect to
DPA) and it turned out that some sponge-based construction might be
ideal for mixing together different entropy sources and for providing
also decent side-channel properties. The idea would be to operate the
sponge in some mode similar to SHAKE, such that it is possible to
extract arbitrary length strings. For mixing in entropy, one might run
the permutation, xor the new entropy inputs into the state and run the
permutation once again before continuing with pulling out further random
bits. In the end one might have a moving target for SCA and a quite
efficient construction at the same time and this would be independent
from the rate that a TRNG or other entropy source produces new data.?

Here I would like to ask whether somebody is actually aware of such a
system or a paper considering it and whether a sponge-based approach has
also been considered for the randomness-improvement draft?

I am asking specifically because for the very same use-cases the
external reviewers that we have asked for approval of our
production-code implementations requested us to use a rather complex
construction based on a combination of HKDF and AES-CTR for generating
the random streams which I believe to be worse than a sponge
construction from a side-channel perspective.

I'd appreciate to learn whether somebody is aware of some scientific
paper regarding efficient sponge based RNG constructions for scenarios
which are targeted by the randomness-improvements draft.

Yours,

Björn