Subject: [CFRG] Comments on draft-irtf-cfrg-opaque-07

From: [email-masked]
Date: Wed, 29 Dec 2021 21:49:45 -0600 (CST)

https://www.ietf.org/archive/id/draft-irtf-cfrg-opaque-07.html#section-10.2-2

> sWe note that as...

Typo: "sWe".

https://www.ietf.org/archive/id/draft-irtf-cfrg-opaque-07.html#section-7-2.3

> The MHF has fixed parameters, chosen by the application, and implements the interface in Section 2. Examples include Argon2 [ARGON2], scrypt [SCRYPT], and PBKDF2 [PBKDF2] with fixed parameter choices.

If MHF includes PBKDF2 then we need to change the name. Since MHF means Memory Hard Function. Maybe "Slow KDF" or "Key Stretching Function"? I vote KSF.

This is ambiguous: "The MHF has fixed parameters, chosen by the application...". It either means the application should have one baked in set of parameters (eg use Argon2id with m=37*1024, t=1, p=1) or the settings can be updated and are sent to the client during login (either actual parameters or version number for parameters). I'm hoping you mean the latter. Anyway it should be made clear that for everyone that doesn't get like 10k successful logins per second then unauthenticated parameters can be sent to the client. Also even if you're Facebook or Google, this can be solved by having the client enforce minimum parameters.