Subject: [Cfrg] Jianfei He's No Objection on draft-irtf-cfrg-randomness-improvements-12: (with COMMENT)

From: Jianfei He via Datatracker <[email-masked]>
Date: Tue, 26 May 2020 18:48:47 -0700

Jianfei He has entered the following ballot position for
draft-irtf-cfrg-randomness-improvements-12: No Objection

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)

The document, along with other ballot positions, can be found here:
https://datatracker.ietf.org/doc/draft-irtf-cfrg-randomness-improvements/

----------------------------------------------------------------------
COMMENT:
----------------------------------------------------------------------

The document is generally clear in its objective and methods. One comment is on
"the length  M" at the 2nd paragraph in section 3 "Randomness Wrapper". It is
not explicitly described how to decide this value.

In RFC 5869, it is stated as below：
"Ideally, the salt value is a random (or pseudorandom) string of the length
HashLen.  Yet, even a salt value of less quality (shorter in size or with
limited entropy) may still make a significant contribution to the security of
the output keying material"

But to the specific application in this draft, it is not sure M chould be
almost arbitary, or M =< L, or there are more specific suggestions from best
practices.