Subject: [Curdle] On SSH-XMSS

From: Marian Sigler <[email-masked]>
Date: Tue, 31 Mar 2020 19:00:31 +0200

Hi everyone.

I've stumbled upon the SSH-XMSS draft [1], and, after being very
astonished about it not mentioning the problems arising from XMSS's
statefulness, I found your discussion and I am glad that you decided not
to proceed on it.
I was wondering if it was possible to add a note to the draft that it
has been rejected?

Also, NIST has now published the Recommendations about stateful schemes
you've been talking about as a draft (already in December, actually) :

https://doi.org/10.6028/NIST.SP.800-208-draft

Since it hasn't been mentioned here, I thought some of you might
appreciate the hint.

To summarize: The recommendation explicitly forbids any use of XMSS
outside of hardware security modules. Further, it demands that the keys
be generated inside the hardware module, and that it never exports
private keying material.

Marian

[1] https://tools.ietf.org/id/draft-mu-curdle-ssh-xmss-00.html

---

From: "Salz, Rich" <[email-masked]>
Date: Wed, 1 Apr 2020 13:38:11 +0000

has been rejected?

This is generally not done.  The email archive is the record of discussion.

---

From: denis bider <[email-masked]>
Date: Wed, 1 Apr 2020 09:43:33 -0500

has been rejected?
> This is generally not done.  The email archive is the record of
discussion.

Let this be my contribution to the email record, then, suggesting that
updating the draft as Marian suggests is what SHOULD be done.

Discoverability is important and policies such as the one you outline
reduce it, I estimate, by two orders of magnitude.

(For similar reasons, the text of already published RFCs should be updated
with errata, rather than attaching them separately. That current practice
reduces discoverability, I estimate, by one order of magnitude.)

denis

On Wed, Apr 1, 2020 at 8:38 AM Salz, Rich <rsalz=[email-masked]>
wrote:

> _______________________________________________
> Curdle mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/curdle
>

---

From: Benjamin Kaduk <[email-masked]>
Date: Wed, 1 Apr 2020 21:26:50 -0700

> updating the draft as Marian suggests is what SHOULD be done.

There's nothing preventing the WG chairs from having a document editor (not
necessarily the current one) upload a final revision with a "tombstone"
indicating it's dead and why.  The IESG discussed this general topic at one
point but it's not really the sort of thing that should get mandated,
though having it as an option in the toolbox is useful.

> reduces discoverability, I estimate, by one order of magnitude.)

In the past year a new mechanism was introduced that shows the results of
applying the (verified) errata on top of the document itself, e.g., at
https://www.rfc-editor.org/rfc/inline-errata/rfc5280.html .  There's a link
from the RFC Editor's document-info page next to the link for the "regular"
HTMLized version.

-Ben