Subject: [Cfrg] DNSSEC considering adopting GOST R 34.10-2001 and GOST R 34.11-94

From: Ólafur Guðmundsson /DNSEXT chair <[email-masked]>
Date: Wed, 22 Apr 2009 11:13:32 -0400

This message is a request for information.
In an old CFRG thread
http://www.ietf.org/mail-archive/web/cfrg/current/msg01170.html
I asked for some guidance on defining ECC algorithms for DNSSEC.

We now have the first concrete proposal for an ECC algorithm,
         GOST R 34.10-2001 a ECC public key algorithm
         GOST R 34.11-94  a hash algorithm
preliminary ID: (more politics than technical)
http://www.ietf.org/internet-drafts/draft-dolmatov-dnsext-dnssec-gost-00.txt

Both algorithms have been added to at least one IETF protocol (RFC4490).
The DNS community is inclined to seriously consider the adoption of these
algorithms, but we are not crypto experts.

Question #1: Is there a cryptographic reason why GOST R 34.10-2001
should NOT be considered for adoption by DNS?

Previously I have received suggestions for following ECC curves:
         P-256, P-384 and Curve25519.

Question #2: Is there a cryptographic reason why GOST R 34.11-94
should NOT be considered for adoption by DNS?

         thanks
         Olafur

---

From: "Jim Schaad" <[email-masked]>
Date: Wed, 22 Apr 2009 13:13:52 -0700

I would like to note that we added this without having actually seen the
details of the algorithm itself.

Jim Schaad

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On Behalf Of
> Ólafur Guðmundsson /DNSEXT chair
> Sent: Wednesday, April 22, 2009 8:14 AM
> To: [email-masked]
> Subject: [Cfrg] DNSSEC considering adopting GOST R 34.10-2001 and GOST
> R 34.11-94
> 
> 
> _______________________________________________
> Cfrg mailing list
> [email-masked]
> http://www.irtf.org/mailman/listinfo/cfrg

---

From: Paul Hoffman <[email-masked]>
Date: Wed, 22 Apr 2009 13:26:22 -0700

>details of the algorithm itself.

To be more precise: the spec is in Russian, and the official English translations are pretty expensive. The S/MIME WG pretty much punted on the review, giving a "national body" the benefit of the doubt.

--Paul Hoffman, Director
--VPN Consortium

---

From: David McGrew <[email-masked]>
Date: Mon, 27 Apr 2009 06:00:58 -0700

Hi Olafur,

some other important questions: how widely reviewed is that  
algorithm?  What are the claimed security levels?   Where is guidance  
on how to use the algorithm?

I cannot find any references to it in the peer-reviewed literature.    
Perhaps I am not using the right keyword or something.

If anyone on the CFRG list has reviewed the algorithm, it would be  
great if we could hear from them.

best,

David

---

From: Paul Hoffman <[email-masked]>
Date: Mon, 27 Apr 2009 07:40:27 -0700

At 6:00 AM -0700 4/27/09, David McGrew wrote:
>some other important questions: how widely reviewed is that algorithm? 

I believe that Ólafur would like CFRG to determine the answer to that question. The expertise for "how widely reviewed" is in this group, not in DNSEXT.

>What are the claimed security levels?  

And herein lies a problem. The GOST specs are in Russian. I do not believe that there are any official English translations, and that the unofficial ones are expensive. (I would love to be wrong about either of those statements.) I have Cc' the author of the relevant draft on this message so he can help.

>Where is guidance on how to use the algorithm?

In the draft itself: <http://www.ietf.org/internet-drafts/draft-dolmatov-dnsext-dnssec-gost-00.txt>

>Perhaps I am not using the right keyword or something.

Here are a few:

<http://www.iacr.org/conferences/asiacrypt2005/rump/Dunkelman_AC05_Rump.pdf>

<https://online.tu-graz.ac.at/tug_online/voe_main2.getVollText?pDocumentNr=80200&pCurrPk=36649>

<https://online.tu-graz.ac.at/tug_online/voe_main2.getvolltext?pDocumentNr=81262>

>If anyone on the CFRG list has reviewed the algorithm, it would be great if we could hear from them.

Yes, please!

--Paul Hoffman, Director
--VPN Consortium

---

From: Christian Rechberger <[email-masked]>
Date: Mon, 27 Apr 2009 17:02:52 +0200

Quoting Paul Hoffman <[email-masked]>:

> I believe that Ólafur would like CFRG to determine the answer to  
> that question. The expertise for "how widely reviewed" is in this  
> group, not in DNSEXT.
>
> And herein lies a problem. The GOST specs are in Russian. I do not  
> believe that there are any official English translations, and that  
> the unofficial ones are expensive. (I would love to be wrong about  
> either of those statements.) I have Cc' the author of the relevant  
> draft on this message so he can help.
>
> In the draft itself:  
> <http://www.ietf.org/internet-drafts/draft-dolmatov-dnsext-dnssec-gost-00.txt>
>
>
I'm one of the authors of the above mentioned papers.

To cut a long story short: We looked at the alleged GOST hash (using a  
unofficial translations and help from people knowing Russian), and  
found both collision and preimage attacks, suggesting that the GOST  
hash function is less secure than one would expect from a "good" hash  
function.

Note that none of the attacks we propose is practical. Still, no such  
attacks are known on any of the SHA-2 hash functions.

Best regards,
  Christian

---

From: Basil Dolmatov <[email-masked]>
Date: Tue, 28 Apr 2009 10:26:07 +0400

Paul Hoffman пишет:
Hi Paul,

> And herein lies a problem. The GOST specs are in Russian. I do not believe that there are any official English translations, 
> and that the unofficial ones are expensive. (I would love to be wrong about either of those statements.) 
 >I have Cc' the author of the relevant draft on this message so he can 
help.

Because of expensiveness of existing translations I can only "lend" my 
copies for the purpose of review by professionals, members of Cfrg, 
provided these copies will never made publicly available on the Internet 
or distributed by any other means to other people/enterprises except 
those who have got it from me directly.

Those, who are willing to lend a copy can address me via e-mail.

Thanks for understanding,

============================
Vasily Dolmatov, CCIE #5347
Deputy Director, Cryptocom Ltd.

---

From: Eric Rescorla <[email-masked]>
Date: Tue, 28 Apr 2009 06:06:43 -0700

At Tue, 28 Apr 2009 10:26:07 +0400,
Basil Dolmatov wrote:
> Paul Hoffman ?????:

Shouldn't reliance on a non-public spec pretty much be a dealbreaker
for standardization of an algorithm?

-Ekr

---

From: [email-masked]
Date: Tue, 28 Apr 2009 13:08:47 +0000

> for standardization of an algorithm?

	Please.  the spec is public.  Is there any rule in place that specifications
	must be available in ENGLISH to be considered publically available?

--bill

---

From: Eric Rescorla <[email-masked]>
Date: Tue, 28 Apr 2009 06:31:26 -0700

> 	must be available in ENGLISH to be considered publically available?

Given that the working language of the IETF is English, yes, I
think that's the sense of the rule.

-Ekr

---

From: Basil Dolmatov <[email-masked]>
Date: Tue, 28 Apr 2009 17:50:33 +0400

[email-masked] пишет:

> 	Please.  the spec is public.  
Yes.

One is public for fifteen years, other - for 8.

Everyone who is in charge of anything in cryptography or cryptanalysis 
field *is* acquainted with these algorythms for long.

For those who need a copy to refresh memories I am ready to present it.
> Is there any rule in place that specifications
It is publicly available in C language for years, which is much more 
international one than English <grin>.

dol@

---

From: Eric Rescorla <[email-masked]>
Date: Tue, 28 Apr 2009 07:05:57 -0700

At Tue, 28 Apr 2009 17:50:33 +0400,
Basil Dolmatov wrote:
> 
> 
> 
> [email-masked] ?????:
> 
> >>>

If by "acquainted with" you mean "know that they exist", sure.
If by "acquainted with" you mean that there's been enough serious
analysis to have an informed opinion about the strength of 
these algorithms, then no, not so much.

> international one than English <grin>.

Not really the same thing. If it were, we wouldn't bother
publishing standards.

-Ekr