Subject: Re: [Cfrg] [irsg] IRSG review request: draft-irtf-cfrg-randomness-improvements-11

From: Colin Perkins <[email-masked]>
Date: Mon, 4 May 2020 23:09:51 +0100

Thanks, Mallory!
Colin

> On 28 Apr 2020, at 19:21, Mallory Knodel <[email-masked]> wrote:
> 
> HI all,
> 
> I did an IRSG review for this document. I think that the editorial quality is high; this is not a deep technical review. As I read and noted questions, they were all answered later within the text and with clarity.
> 
> For the last two citations there exist URLs even if the documents being cited aren't openly published. I recommend linking to these pages anyway for verification purposes.
> 
> Thanks,
> -Mallory
> 
> On Mon, Apr 20, 2020 at 6:44 PM Colin Perkins <[email-masked] <mailto:[email-masked]>> wrote:
> IRSG members,
> 
> The Crypto Forum Research Group has requested that draft-irtf-cfrg-randomness-improvements-11 <https://datatracker.ietf.org/doc/draft-irtf-cfrg-randomness-improvements/> be considered for publication as an IRTF RFC. To progress this draft, we now need at least one IRSG member to volunteer to provide a detailed review of the draft, as follows:
> 
>> The purpose of the IRSG review is to ensure consistent editorial and technical quality for IRTF publications. IRSG review is not a deep technical review. (This should take place within the RG.) At least one IRSG member other than the chair of the RG bringing the work forth must review the document and the RG’s editorial process.
>> 
>> IRSG reviewers should look for clear, cogent, and consistent writing. An important aspect of the review is to gain a critical reading from reviewers who are not subject matter experts and, in the process, assure the document will be accessible to those beyond the authoring research group. Also, reviewers should assess whether sufficient editorial and technical review has been conducted and the requirements of this process document, such as those described in IRTF-RFCs have been met. Finally, reviewers should check that appropriate citations to related research literature have been made.
>> 
>> Reviews should be written to be public. Review comments should be sent to the IRSG and RG mailing lists and entered into the tracker. All IRSG review comments must be addressed. However, the RG need not accept every comment. It is the responsibility of the shepherd to understand the comments and ensure that the RG considers them including adequate dialog between the reviewer and the author and/or RG. Reviews and their resolution should be entered into the tracker by the document shepherd.
>> 
>> The IRSG review often results in the document being revised. Once the reviewer(s), authors, and shepherd have converged on review comments, the shepherd starts the IRSG Poll on whether the document should be published.
> 
> Please respond to this message if you’re able to perform such a review, and indicate the approximate time-frame by which you’ll be able to complete it. The document shepherd write-up is available at https://datatracker.ietf.org/doc/draft-irtf-cfrg-randomness-improvements/shepherdwriteup/ <https://datatracker.ietf.org/doc/draft-irtf-cfrg-randomness-improvements/shepherdwriteup/>
> 
> Thanks!
> Colin (as IRTF chair)
> 
> 
> -- 
> Colin Perkins
> https://csperkins.org/ <https://csperkins.org/>
> 
> 
> 
> 
> 
> 
> -- 
> Mallory Knodel
> CTO, Center for Democracy and Technology
> gpg fingerprint :: E3EB 63E0 65A3 B240 BCD9 B071 0C32 A271 BD3C C780
>

---

From: Marie-Jose Montpetit <[email-masked]>
Date: Mon, 4 May 2020 18:15:54 -0400

Hello lists:

My review of draft-irtf-cfrg-randomness-improvements-11

Overall:
The draft is well written and the solution very understandable. The
comparison to the existing RFC is 6979 is a very good idea. While the
application to TLS was most likely the reason the draft was written I am
aware of issues with PRGs elsewhere notably the FRECFRAME RLC that was
delayed due to PRG issues. This does not require to be addressed in the
draft but shows that PRG bugs that impact randomness do need to be taken
into account.

In the NITs category I found the following missing acronyms definitions:
DBRG
EC
HKDF
HMAC
HSM
TLS

mjm

Marie-José Montpetit, Ph.D.
[email-masked]

On May 4, 2020 at 6:10:47 PM, Colin Perkins ([email-masked]) wrote:

Thanks, Mallory!
Colin

HI all,

I did an IRSG review for this document. I think that the editorial quality
is high; this is not a deep technical review. As I read and noted
questions, they were all answered later within the text and with clarity.

For the last two citations there exist URLs even if the documents being
cited aren't openly published. I recommend linking to these pages anyway
for verification purposes.

Thanks,
-Mallory

On Mon, Apr 20, 2020 at 6:44 PM Colin Perkins <[email-masked]> wrote:

> IRSG members,
>
> The Crypto Forum Research Group has requested that
> draft-irtf-cfrg-randomness-improvements-11
> <https://datatracker.ietf.org/doc/draft-irtf-cfrg-randomness-improvements/> be
> considered for publication as an IRTF RFC. To progress this draft,
> we now need *at least one* IRSG member to volunteer to provide a detailed
> review of the draft, as follows:
>
> The purpose of the IRSG review is to ensure consistent editorial and
> technical quality for IRTF publications. IRSG review is not a deep
> technical review. (This should take place within the RG.) At least one IRSG
> member other than the chair of the RG bringing the work forth must review
> the document and the RG’s editorial process.
>
> IRSG reviewers should look for clear, cogent, and consistent writing. An
> important aspect of the review is to gain a critical reading from reviewers
> who are not subject matter experts and, in the process, assure the document
> will be accessible to those beyond the authoring research group. Also,
> reviewers should assess whether sufficient editorial and technical review
> has been conducted and the requirements of this process document, such as
> those described in IRTF-RFCs have been met. Finally, reviewers should check
> that appropriate citations to related research literature have been made.
>
> Reviews should be written to be public. Review comments should be sent to
> the IRSG and RG mailing lists and entered into the tracker. All IRSG review
> comments must be addressed. However, the RG need not accept every comment.
> It is the responsibility of the shepherd to understand the comments and
> ensure that the RG considers them including adequate dialog between the
> reviewer and the author and/or RG. Reviews and their resolution should be
> entered into the tracker by the document shepherd.
>
> The IRSG review often results in the document being revised. Once the
> reviewer(s), authors, and shepherd have converged on review comments, the
> shepherd starts the IRSG Poll on whether the document should be published.
>
>
> Please respond to this message if you’re able to perform such a review,
> and indicate the approximate time-frame by which you’ll be able to complete
> it. The document shepherd write-up is available at
> https://datatracker.ietf.org/doc/draft-irtf-cfrg-randomness-improvements/shepherdwriteup/
>
> Thanks!
> Colin (as IRTF chair)
>
>
> --
> Colin Perkins
> https://csperkins.org/
>
>
>
>
>

---

From: Colin Perkins <[email-masked]>
Date: Mon, 4 May 2020 23:23:50 +0100

Thank you!

Authors: would it be possible to spin a quick revision of the draft to address the nits in these reviews?

Colin

> On 4 May 2020, at 23:15, Marie-Jose Montpetit <[email-masked]> wrote:
> 
> Hello lists:
> 
> The draft is well written and the solution very understandable. The comparison to the existing RFC is 6979 is a very good idea. While the application to TLS was most likely the reason the draft was written I am aware of issues with PRGs elsewhere notably the FRECFRAME RLC that was delayed due to PRG issues. This does not require to be addressed in the draft but shows that PRG bugs that impact randomness do need to be taken into account.
> 
> [email-masked] <mailto:[email-masked]>
> 
> 
> 
> On May 4, 2020 at 6:10:47 PM, Colin Perkins ([email-masked] <mailto:[email-masked]>) wrote:
> 
>> Thanks, Mallory!
>> Colin
>> 
>> 
>> 
>>> On 28 Apr 2020, at 19:21, Mallory Knodel <[email-masked] <mailto:[email-masked]>> wrote:
>>> 
>>> HI all,
>>>

---

From: "Stanislav V. Smyshlyaev" <[email-masked]>
Date: Tue, 5 May 2020 14:44:43 +0300

Dear Colin,

Many thanks for the update!
We'll have a short discussion of the comments with Chris, Cas, Luke and
Nick and update the draft based on the comments. Many thanks for the
comments, Marie-Jose and Mallory!

Colin, one more question. You've added a comment for the draft at the
datatracker: "Revision needed to clarify what is mandatory to implement,
and to address review from Gwynne Raskind." - shouldn't this be
about draft-irtf-cfrg-argon2 (not
about draft-irtf-cfrg-randomness-improvements)?..

Best regards,
Stanislav

On Tue, 5 May 2020 at 01:24, Colin Perkins <[email-masked]> wrote:

>> we now need *at least one* IRSG member to volunteer to provide a
>> detailed review of the draft, as follows:
>>

---

From: Colin Perkins <[email-masked]>
Date: Tue, 5 May 2020 13:07:18 +0100

Hi Stanislav,

> On 5 May 2020, at 12:44, Stanislav V. Smyshlyaev <[email-masked]> wrote:
> 
> Dear Colin,
> 
> We'll have a short discussion of the comments with Chris, Cas, Luke and Nick and update the draft based on the comments. Many thanks for the comments, Marie-Jose and Mallory!
> 
> Colin, one more question. You've added a comment for the draft at the datatracker: "Revision needed to clarify what is mandatory to implement, and to address review from Gwynne Raskind." - shouldn't this be about draft-irtf-cfrg-argon2 (not about draft-irtf-cfrg-randomness-improvements)?..

Yes – sorry, did I enter that in the wrong draft? Will fix.

-- 
Colin Perkins
https://csperkins.org/

---

From: "Stanislav V. Smyshlyaev" <[email-masked]>
Date: Tue, 5 May 2020 19:09:38 +0300

Dear Colin,

We've updated the draft (draft-irtf-cfrg-randomness-improvements-12),
addressing the nits listed in both reviews.

Regards,
Stanislav

On Tue, 5 May 2020 at 15:07, Colin Perkins <[email-masked]> wrote:

> and to address review from Gwynne Raskind." - shouldn't this be about
> draft-irtf-cfrg-argon2 (not about
> draft-irtf-cfrg-randomness-improvements)?..
>