Subject: Re: [Cfrg] RFC 5116 update?

From: John Mattsson <[email-masked]>
Date: Thu, 13 Sep 2018 08:42:28 +0000

Hi,

After finding out that https://tools.ietf.org/html/draft-mcgrew-iv-gen-03 existed a month ago, I have already referred to it several times in discussions and contributions to various SDOs, so my opinion that it should be published have only increased. As I have found it useful also for discussions on non-AEAD algorithms, I agree that updating and publishing draft-mcgrew-iv-gen-03 separately from RFC5116bis is the best option.

I’m also willing to help with both efforts.

/John

On 2018-08-31, 03:36, "Christopher Wood" <[email-masked]> wrote:

On Thu, Aug 30, 2018 at 5:43 PM Martin Thomson <[email-masked]> wrote:
>
> On Fri, Aug 31, 2018 at 5:06 AM Christopher Wood
> <[email-masked]> wrote:
> > Given the scope of the document, I would like to see draft-mcgrew-iv-gen
> > move forward, and referencing it in RFC5116bis seems best. I’m willing
> > to help both efforts.
>
> The work is certainly valuable, but the framing seems a little off.
> In the settings you are concerned with, the primary characteristic we
> are concerned with is that the IV is unique.  That we use a
> deterministic process to produce this value [1], isn't the main point
> and it could result in some misconceptions about what is going on.

Yes, good point. It should be clear that techniques such as those
listed in [1] exist to construct (for these settings) unique IVs.

> I'd like to see this include some discussion of nonce-misuse-resistant
> primitives as well, noting how they fit into the picture.

Agreed.

> [1] A counter, a counter mixed with some other value (concatenation,
> XOR, and add have all been used), a function over the plaintext or
> other inputs, a counter and PRP, ..., honestly I don't know why anyone
> would think a mere 26 pages is enough!

:-)