Subject: [Cfrg] UMAC draft version 06

From: David Wagner <[email-masked]>
Date: Thu, 20 Oct 2005 09:52:39 -0700 (PDT)

Dan Bernstein writes:
>Hugo Krawczyk writes:
>> There were NO no new security claims nor new proofs since Ted's thesis
>> which has been in the public domain since 2000
>
>False. Consider, for example, the following security claim appearing in
>draft-krovetz-umac-05.txt, [..]

umac-05.txt is a previous version.  The current version is umac-06.txt.

Can't we focus in on the current version, please?

_______________________________________________
Cfrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/cfrg

---

From: "D. J. Bernstein" <[email-masked]>
Date: 20 Oct 2005 21:57:59 -0000

> Can't we focus in on the current version, please?

The previous versions have some false and questionable security claims
that, to date, have not been withdrawn by the authors. The new security
claims are being presented as mere ``clarifications'' of the old
security claims---``clarifications'' that don't need serious review.

In a perfect world, the previous claims wouldn't have been made at all,
and we'd give the new claims a serious review. In the real world, we
have even more reason to worry about the possibility of errors in the
new claims, and even more reason to carry out a serious review of those
claims. A rushed review schedule is irresponsible.

I'm also a little worried about the possibility of readers bumping into
the previous security claims (despite the IETF's best efforts to wipe
old drafts from the face of the earth) along with the authors' continued
endorsement of those claims. But my main concern is with the possibility
of errors in the new claims.

---D. J. Bernstein, Professor, Mathematics, Statistics,
and Computer Science, University of Illinois at Chicago