Subject: Re: [Spasm] I-D Action: draft-ietf-lamps-rfc5751-bis-01.txt

From: Wei Chuang <[email-masked]>
Date: Fri, 2 Sep 2016 10:15:05 -0700

Also many thanks for the update.

I asked for feedback internally.  Two things from that:
1. The AES-GCM IV length should not use the default RFC5084 12 byte length,
and instead should use 16 bytes.  This is from Quan Nguyen who recently
posted an errata
<https://www.ietf.org/mail-archive/web/smime/current/msg19158.html> that
has more background (S/MIME list). Perhaps this could be added to the
security section in the draft?
2. Consideration for chunking of the ciphertext.  There's a related post
<https://www.ietf.org/mail-archive/web/spasm/current/msg00391.html> on the
Spasm list by Adam Langley.
Otherwise it sounds positive.

-Wei

On Mon, Aug 29, 2016 at 9:29 PM, Russ Housley <[email-masked]> wrote:

> I did a very quick skim of the -01 version.  Thanks.
>
> I expected Section 2.3 to include ECDH and X25519.  If they are added,
> some related guidance will be needed in Sections 4.4 and 4.5.
>
> Section 4 offers guidance about RSA, RSASSA-PSS, RSAES-OAEP, and DH
> algorithms.  It used to contain some guidance about DSA.  Is there any
> reason to remove DSA guidance from 4.2 and 4.3?  I think we need to add
> guidance in Sections 4.2 and 4.3 for ECDSA and EdDSA.
>
> Russ
>
> _______________________________________________
> Spasm mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/spasm
>

---

From: Russ Housley <[email-masked]>
Date: Fri, 2 Sep 2016 14:45:25 -0400

> 1. The AES-GCM IV length should not use the default RFC5084 12 byte length, and instead should use 16 bytes.  This is from Quan Nguyen who recently posted an errata that has more background (S/MIME list). Perhaps this could be added to the security section in the draft?  

I have no objection to the 16 octets, but the attack raised has no relevance to CMS AuthEnvelopedData where a fresh key is used for every encryption.

> 2. Consideration for chunking of the ciphertext.  There's a related post on the Spasm list by Adam Langley.

As I said in response to Adam’s message, I am in favor of preventing yet-to-be-authenticated plaintext from being returned, but this is not just a matter of making a small change to this document.

Russ