Subject: [smime] [Technical Errata Reported] RFC2631 (5480)

From: RFC Errata System <[email-masked]>
Date: Mon, 27 Aug 2018 01:55:37 -0700 (PDT)

The following errata report has been submitted for RFC2631,
"Diffie-Hellman Key Agreement Method".

--------------------------------------
You may review the report below and at:
http://www.rfc-editor.org/errata/eid5480

--------------------------------------
Type: Technical
Reported by: Charlie Zhuo <[email-masked]>

Section: 2.1.1

Original Text
-------------
h is any integer with 1 < h < p-1 such that h{(p-1)/q} mod p > 1
(g has order q mod p; i.e. g^q mod p = 1 if g!=1)

Corrected Text
--------------
h is any integer with 1 < h < p-1 such that h^{(p-1)/q} mod p > 1
(g has order q mod p; i.e. g^q mod p = 1 if g!=1)

Notes
-----
the explanation of h misses exponentiation operation in formula.

Instructions:
-------------
This erratum is currently posted as "Reported". If necessary, please
use "Reply All" to discuss whether it should be verified or
rejected. When a decision is reached, the verifying party  
can log in to change the status and edit the report, if necessary. 

--------------------------------------
RFC2631 (draft-ietf-smime-x942-07)
--------------------------------------
Title               : Diffie-Hellman Key Agreement Method
Publication Date    : June 1999
Author(s)           : E. Rescorla
Category            : PROPOSED STANDARD
Source              : S/MIME Mail Security
Area                : Security
Stream              : IETF
Verifying Party     : IESG

---

From: Russ Housley <[email-masked]>
Date: Mon, 27 Aug 2018 11:32:20 -0400

Wow, this has gone a very long time without anyone noticing.  As far as I can tell, it have not resulted in any implementation errors.

Russ

> On Aug 27, 2018, at 4:55 AM, RFC Errata System <[email-masked]> wrote:
> 
> _______________________________________________
> smime mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/smime

---

From: Peter Gutmann <[email-masked]>
Date: Mon, 27 Aug 2018 15:43:03 +0000

Russ Housley <[email-masked]> writes:

>Wow, this has gone a very long time without anyone noticing.  As far as I can
>tell, it have not resulted in any implementation errors.

Has it resulted in any implementations?

(That's a serious question.  What actually uses X9.42 DH, rather than PKCS #3
DH?  That is, I know that some standards reference that RFC, but what actually
implements it and uses it in the real world?).

Peter.

---

From: Russ Housley <[email-masked]>
Date: Mon, 27 Aug 2018 12:48:15 -0400

> On Aug 27, 2018, at 11:43 AM, Peter Gutmann <[email-masked]> wrote:
> 

I am aware of an implementation that was done 17 or 18 years ago.  I do not know if it is still being used.

Russ

---

From: Peter Gutmann <[email-masked]>
Date: Tue, 28 Aug 2018 04:36:38 +0000

>know if it is still being used.

That's probably the sole implementation I'm aware of as well.  Microsoft did a
(quickly-forgotten) read-only implementation to avoid charges that they didn't
implement a standard properly (a bit of a problem for them in the late '90s),
but that nearly 20-year-old one is the only actual implementation I know of,
and given that there wasn't anything else to talk to with it I don't know
whether it got used much in practice.

For people who enjoy pain, there's a long thread on X9.42 (RFC 2631) issues
starting here:

https://www.ietf.org/mail-archive/web/pkix/current/msg23858.html

with lots of background history and a side order of pies being thrown in
various directions.

Peter.

---

From: Charlie Zhuo <[email-masked]>
Date: Tue, 28 Aug 2018 01:19:53 +0000

I assume that there should be no serious implementation issues, provided that the correct procedure described in section 2.2.1.2 is followed.
Furthermore, some implementation request that value "g" be manually assigned/specified.

This errata aims only to correct the description to keep text, formula and procedure consistent, and to avoid confusions.

Regards,
Charlie

-----Original Message-----
From: Russ Housley <[email-masked]> 
Sent: Tuesday, August 28, 2018 12:48 AM
To: Peter Gutmann <[email-masked]>
Cc: Eric Rescorla <[email-masked]>; Charlie Zhuo <[email-masked]>; Paul Hoffman <[email-masked]>; Ben Kaduk <[email-masked]>; IETF SMIME <[email-masked]>
Subject: Re: [smime] [Technical Errata Reported] RFC2631 (5480)

>> Wow, this has gone a very long time without anyone noticing.  As far 
>> as I can tell, it have not resulted in any implementation errors.
> 
> (That's a serious question.  What actually uses X9.42 DH, rather than 
> PKCS #3 DH?  That is, I know that some standards reference that RFC, 
> but what actually implements it and uses it in the real world?).

Russ