Subject: [Cfrg] Fwd: [Technical Errata Reported] RFC4086 (3106)

From: Stephen Farrell <[email-masked]>
Date: Sun, 05 Feb 2012 13:59:31 +0000

More opinions still welcome:-)
Thanks,
Stephen.

-------- Original Message --------
Subject: [Technical Errata Reported] RFC4086 (3106)
Date: Sun,  5 Feb 2012 03:52:37 -0800 (PST)
From: RFC Errata System <[email-masked]>
To: [email-masked], [email-masked], [email-masked], 
[email-masked]
CC: [email-masked], [email-masked]

The following errata report has been submitted for RFC4086,
"Randomness Requirements for Security".

--------------------------------------
You may review the report below and at:
http://www.rfc-editor.org/errata_search.php?rfc=4086&eid=3106

--------------------------------------
Type: Technical
Reported by: Florian Weimer <[email-masked]>

Section: 4.4

Original Text
-------------
(see below)

Corrected Text
--------------
(remove entire section)

Notes
-----
Compression is not suitable for de-skewing, even if headers are removed. 
For most compression algorithms, discriminators are known. For instance, 
in gzip output, the most significant bit of each byte is set with a 
frequency somewhat above 0.501 (except for small inputs). This means 
that the output is not uniformly distributed even when looking at 
isolated bytes.

I recommend removal of the entire section.

Instructions:
-------------
This errata is currently posted as "Reported". If necessary, please
use "Reply All" to discuss whether it should be verified or
rejected. When a decision is reached, the verifying party (IESG)
can log in to change the status and edit the report, if necessary.

--------------------------------------
RFC4086 (draft-eastlake-randomness2-10)
--------------------------------------
Title               : Randomness Requirements for Security
Publication Date    : June 2005
Author(s)           : D. Eastlake 3rd, J. Schiller, S. Crocker
Category            : BEST CURRENT PRACTICE
Source              : IETF - NON WORKING GROUP
Area                : N/A
Stream              : IETF
Verifying Party     : IESG