Subject: Re: [Cfrg] [irsg] IRSG review of draft-irtf-cfrg-ocb

From: Stephen Farrell <[email-masked]>
Date: Mon, 13 Jan 2014 23:34:53 +0000

Hi David,

On 01/13/2014 07:48 PM, David McGrew wrote:
> So you don't need to look for it: the ticket for draft-irtf-cfrg-ocb
> http://trac.tools.ietf.org/group/irtf/trac/ticket/55
> 
> Stephen, thanks for offering to do the review.

No problem. My review below. My points are all nits. This is
ready.

- I think s/privacy/confidentiality/g would be a good change.
Privacy involves more than confidentiality and crypto only
provides the latter. But this draft is by no means the only
sinner in this respect.

- "As with most modes of operation, security degrades in the
square of the number of blocks of texts divided by two to the
blocklength." That could do with a reference or being expanded a
bit. The CFRG reader should be ok with it but if/when OCB gets
some IETF adoption, or when this is read by less crypto-aware
folk, that will be too terse I think. (The same point is made in
the security considerations more clearly so maybe could be
deleted from the earlier section. But maybe its now in twice
because of someone else's comment;-)

- I didn't check the algorithm description nor examples in
detail as IRSG review assumes the RG did that.

Process crapology below. CFRG can ignore.

- Section 6 - Its normal to actually ask IANA to do stuff so
they know what to do when reviewing the draft. And then the text
is changed by the RFC editor to say that IANA has added etc. No
big deal because they'll figure it out.

- Not related to this draft: RFC 5116 says AEAD registrations
SHOULD be reviewed by CFRG. What if CFRG ceases to exist? Be no
harm to sometime say who'd inherit that role maybe. I guess if
the IRTF don't say, and if/when CFRG passes away, then IANA will
ask the IAB/IRSG/IESG probably and there'll be a minor fuss when
someone gets the wrong end of the stick. That's one for Lars
really - what should happen in general with IANA registries
depending on expired RGs for review? (My take - IRTF chair
appoints an expert reviewer or two when killing an RG with
registries and use IRSG list for discussion of requests until
that gets to be a PITA. But before Lars asks, no, I won't
write a draft describing that just now:-)

- I note that the IETF tools page doesn't list the IPR for this
but does for draft-krovetz-ocb. The datatracker page does show
the IPR correctly. I thought that had been fixed since the
replaced-by stuff seems right here. Ah well.

Cheers,
S.

---

From: David McGrew <[email-masked]>
Date: Fri, 17 Jan 2014 08:25:45 -0500

Hi Stephen,

thanks again for your timely review.   A comment inline on the process 
crapology:

On 01/13/2014 06:34 PM, Stephen Farrell wrote:
> SHOULD be reviewed by CFRG.

IANA let me know that they were asking IESG to identify an expert for 
the expert review as per RFC 5116.   I offered to be that person, and I 
did the review and got back to them with an "OK" on the draft.   
Hopefully they will take me at my word regarding that RFC ;-)

I am not sure how the broader process should work relative to IRTF, 
which is a good question.

David

> What if CFRG ceases to exist? Be no
> _______________________________________________
> Cfrg mailing list
> [email-masked]
> http://www.irtf.org/mailman/listinfo/cfrg
> .
>