Subject: Re: [lamps] WGLC comments draft-ietf-lamps-cms-shakes-01

From: Russ Housley <[email-masked]>
Date: Mon, 17 Sep 2018 05:47:16 -0400

> On Sep 5, 2018, at 12:47 PM, Jim Schaad <[email-masked]> wrote:
> 
> * Message Authentication Codes - Do we need to address a potential request
> from some of the IOT worlds such as SUIT where they want to use KMAC, but
> would be happy with a smaller authentication value?
>  
> Comment 6: Shorter tags are generally ok depending on each application: what are the potential attacks/issues and how much data are MACed under a random key. 
>  
> How small would you like for SUIT ? What is the maximum amount of data that will ever be MACed under ONE random key ?
>  
> This is for CMS, I don't think there is a need to reduce the size. But I could be wrong about this.  
> [JLS] One of the message formats that SUIT was using the last time I checked was CMS.  This means that if SUIT wants it then yes it would be for CMS.  Russ – do you think that they are going to want a “truncated” tag for KMAC?

SUIT will focus on COSE structures, but the charter allows a rfc4108bis.

So far, size in SUIT has not been a sticking point.  When the signature value or authentication tag is compared to a software image, a few extra octets is not a show stopper.

Russ

---

From: Russ Housley <[email-masked]>
Date: Mon, 17 Sep 2018 05:53:14 -0400

Here is a part of a message to resolve the WG Last Call comments on draft-ietf-lamps-cms-shakes-01 ...

> * Message Digests - are the limits on the size only for CMS or do they apply
> everywhere that the algorithm is used.  If it is everywhere how do we
> reconcile with the usage in RSA-PSS? 
>  
> Comment 5: Only in CMS, when a message digest is generated. For RSA-PSS,  a SHAKE has 2 different output sizes for 2 different uses: hashing a message to be signed and generating a masking value in MGF 1. 
> [JLS] After looking at this a second time, I propose that this problem be solved by creation of a new mask generation function MGF-V.   We can eliminate the counter from the operation as being un-needed and just compute the mask length and generate that many bits of input from a SHAKE function.
>  
> I thought about that. But that would be another standard function which have not been defined  yet. How could we go from here ? And this route would take time. Using the existing MGF 1 would waste only 1 division: to figure out counter number is zero: so there is only one hash function execution. 
> [JLS2] No it is more than that.  It takes both the one division AND a concatenation AND the strangeness for trying to decide how long the SHAKE output is if one is placing it into an existing MGF1 piece of code.  If you define a new MGF-V then there is a new function that is called – which code should potentially be setup for – and zero extra work beyond that.  The size of the mask is the size of the output, no concatenation.  It is much cleaner in my opinion.

Does anyone think that using SHAKE in the RSA-PSS mask generation function is the wrong approach?

Russ

---

From: Joan Daemen <[email-masked]>
Date: Mon, 17 Sep 2018 14:40:12 +0200

Hi all,

> function is the wrong approach?
On the contrary, using SHAKE (or cSHAKE if you wish) in the RSA-PSS mask
generating function is THE sound approach.

Kind regards,

Joan Daemen

---

From: Joan Daemen <[email-masked]>
Date: Mon, 17 Sep 2018 14:45:03 +0200

Hi all,

sorry for spamming but I see now that my previous message can be
misinterpreted. What I mean is that one should replace (SHA1+MGF1) by
SHAKE and one should certainly not replace (SHA1+MGF1) by (SHAKE+MGF1).

Kind regards,

Joan Daemen

On 17/09/2018 14:40, Joan Daemen wrote:
> _______________________________________________
> Spasm mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/spasm

---

From: Jim Schaad <[email-masked]>
Date: Mon, 17 Sep 2018 08:38:37 -0700

Russ,

That is not the question that I was asking.  I think that replacing SHA-1 with SHAKE in the MFG function is correct.  I was proposing replacing the MFG function in its entirety with a new MFG function.

Jim

From: Spasm <[email-masked]> On Behalf Of Russ Housley
Sent: Monday, September 17, 2018 2:53 AM
To: Quynh Dang <[email-masked]>; Panos Kampanakis <[email-masked]>
Cc: SPASM <[email-masked]>
Subject: Re: [lamps] WGLC comments draft-ietf-lamps-cms-shakes-01

Russ

---

From: "Panos Kampanakis (pkampana)" <[email-masked]>
Date: Mon, 17 Sep 2018 18:08:51 +0000

I think that falls outside the scope of this spec and the LAMPS charter to be honest.
I mean, introducing a new MFG should not be taken lightly even if it is straightforward.
Panos

From: Jim Schaad [mailto:[email-masked]]
Sent: Monday, September 17, 2018 11:39 AM
To: 'Russ Housley' <[email-masked]>; 'Quynh Dang' <[email-masked]>; Panos Kampanakis (pkampana) <[email-masked]>
Cc: 'SPASM' <[email-masked]>
Subject: RE: [lamps] WGLC comments draft-ietf-lamps-cms-shakes-01

Russ,

Jim

From: Spasm <[email-masked]<mailto:[email-masked]>> On Behalf Of Russ Housley
Sent: Monday, September 17, 2018 2:53 AM
To: Quynh Dang <[email-masked]<mailto:[email-masked]>>; Panos Kampanakis <[email-masked]<mailto:[email-masked]>>
Cc: SPASM <[email-masked]<mailto:[email-masked]>>
Subject: Re: [lamps] WGLC comments draft-ietf-lamps-cms-shakes-01

Russ

---

From: Russ Housley <[email-masked]>
Date: Mon, 17 Sep 2018 14:51:44 -0400

Quynh, Panos, and Jim:

While it does look like a simple substitution, I do not think the LAMPS is the right group to make the assessment.  CFRG may have people with the right skills.

Russ

> On Sep 17, 2018, at 2:08 PM, Panos Kampanakis (pkampana) <pkampana=[email-masked]> wrote:
> 
> From: Jim Schaad [mailto:[email-masked] <mailto:[email-masked]>] 
> To: 'Russ Housley' <[email-masked] <mailto:[email-masked]>>; 'Quynh Dang' <[email-masked] <mailto:[email-masked]>>; Panos Kampanakis (pkampana) <[email-masked] <mailto:[email-masked]>>
> Cc: 'SPASM' <[email-masked] <mailto:[email-masked]>>
> From: Spasm <[email-masked] <mailto:[email-masked]>> On Behalf Of Russ Housley
> To: Quynh Dang <[email-masked] <mailto:[email-masked]>>; Panos Kampanakis <[email-masked] <mailto:[email-masked]>>
> Cc: SPASM <[email-masked] <mailto:[email-masked]>>

---

From: Jim Schaad <[email-masked]>
Date: Mon, 17 Sep 2018 12:49:16 -0700

Ok – then lets send a request to CFRG to look at this and tell us if I am crazy to want to do this.  

Jim

From: Spasm <[email-masked]> On Behalf Of Russ Housley
Sent: Monday, September 17, 2018 11:52 AM
To: panos Kampanakis <[email-masked]>; Jim Schaad <[email-masked]>; Quynh Dang <[email-masked]>
Cc: SPASM <[email-masked]>
Subject: Re: [lamps] WGLC comments draft-ietf-lamps-cms-shakes-01

Quynh, Panos, and Jim:

Russ

On Sep 17, 2018, at 2:08 PM, Panos Kampanakis (pkampana) <pkampana=[email-masked] <mailto:pkampana=[email-masked]> > wrote:

Panos

From: Jim Schaad [ <mailto:[email-masked]> mailto:[email-masked]] 
Sent: Monday, September 17, 2018 11:39 AM
To: 'Russ Housley' < <mailto:[email-masked]> [email-masked]>; 'Quynh Dang' < <mailto:[email-masked]> [email-masked]>; Panos Kampanakis (pkampana) < <mailto:[email-masked]> [email-masked]>
Cc: 'SPASM' < <mailto:[email-masked]> [email-masked]>
Subject: RE: [lamps] WGLC comments draft-ietf-lamps-cms-shakes-01

Russ,

Jim

From: Spasm < <mailto:[email-masked]> [email-masked]> On Behalf Of Russ Housley
Sent: Monday, September 17, 2018 2:53 AM
To: Quynh Dang < <mailto:[email-masked]> [email-masked]>; Panos Kampanakis < <mailto:[email-masked]> [email-masked]>
Cc: SPASM < <mailto:[email-masked]> [email-masked]>
Subject: Re: [lamps] WGLC comments draft-ietf-lamps-cms-shakes-01

Russ

---

From: Russ Housley <[email-masked]>
Date: Mon, 17 Sep 2018 17:00:28 -0400

I sent the query.  For those who are not on the CFRG list, the archive message is here:

	https://mailarchive.ietf.org/arch/msg/cfrg/VVm9BQZSOHpaFR4ZQMQPUFtgjOk <https://mailarchive.ietf.org/arch/msg/cfrg/VVm9BQZSOHpaFR4ZQMQPUFtgjOk>

Russ

> On Sep 17, 2018, at 3:49 PM, Jim Schaad <[email-masked]> wrote:
>