Subject: [Cfrg] Please stop the UMAC posts!

From: David Wagner <[email-masked]>
Date: Tue, 4 Oct 2005 17:16:40 -0700 (PDT)

As far as I can tell, DJB's observations and requests seem reasonable,
though not necessarily a reason to preclude UMAC from standardization.

If I understand correctly, he is asking for (a) a precise security claim
of what is achieved by the full UMAC message authentication scheme;
(b) a complete proof of this security claim.

If a scheme claims to provide provable security, it's not unreasonable
to ask for these things, and if they are missing, to point out that fact.
As far as I can tell, DJB is right that these two really are missing.

(There are some claims and proofs about the UMAC 2-universal hash, but
that's just a component in the UMAC authentication scheme.  Of course,
everything else is standard and well-understood, so the 2-universal hash
is undoubtedly by far the most important and error-prone component, and
the proofs about the 2-univ hash probably take us 99% of the way there
towards proofs for the whole scheme.)

It sounds like it would be easy and straightforward to get from the
published theorems about the UMAC 2-universal hash function to what DJB is
asking for.  I didn't see any reason to think filling out the gaps would
be hard.  But even so, it is not unreasonable to ask that the proposer
of the scheme do this work, rather than the reviewers.  Reviewers should
not have to interpolate missing steps in the security analysis, and if
any steps are missing, it is reasonable to call attention to this fact.
Normally we would place the burden on the proposer to do a detailed
security analysis before submission.

With all that said, I personally don't see anything that would make
me reluctant to standardize UMAC.  As far as I can tell, the gaps in
the proofs seem to be minor enough that I don't foresee any significant
danger that UMAC will be insecure.  So, personally, I wouldn't have any
objections to standardizing UMAC despite DJB's (accurate) comments.

_______________________________________________
Cfrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/cfrg

---

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Fri, 7 Oct 2005 06:42:54 -0700

I don't think the tenor of the current debate is useful. I am replying
to this thread to avoid the other one.

In the interests of raising the general level of decorum I suggest this
issue be decided according to trial by combat as described in RFC2832.3
section 13.