Subject: Re: [Cfrg] ECC Encryption questions

From: David Wagner <[email-masked]>
Date: Thu, 24 Jun 2010 11:31:13 -0700 (PDT)

Dan Brown  wrote:
> How valuable is it to be "hash" free?  Should standardizers, eg IETF,
> be going out of their way to support such modes?

I think you raise a good point.

Personal opinion: In some settings (e.g., very low-end embedded devices),
there might be some small value to hashless cryptographic modes.
However I think it would be premature for the IETF to go out of its way
to support such modes at this time.  I think the IETF should not consider
standardizing them until someone with both significant cryptographic
knowledge and significant practical experience is able to report to the
IETF about their experience, demonstrate convincingly that they have
considered all alternatives, propose a concrete set of hashless modes,
quantify the benefit of those hashless modes over the next-best standard
set of modes, and generally make the case for some concrete step the
IETF could take.

Right now, I think the status quo is that if you have an embedded device
with severe resource constraints, you should hire a knowledgeable
cryptographer to design the best solution, given those constraints.
I don't see a convincing argument that the IETF needs to step in to do
anything to change the status quo.  The status quo seems OK.

By the way, I don't think it's a good use of this mailing list to use
it as a general help desk for crypto questions.  I understood that the
purpose of this mailing list was to support standardization efforts,
not to serve as a general forum for "can someone help me understand
crypto?" questions.  I would suggest that the CFRG chairs declare the
threads about "how does ECC work?  can ECC do this?  is it possible to do
public-key crypto without hashes?" closed and off-topic.  Those questions
belong somewhere else, in my personal opinion.

---

From: "Martin Abadi" <[email-masked]>
Date: Thu, 24 Jun 2010 11:43:07 -0700

Fwiw, I second David on the scope of the list.

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of
David Wagner
Sent: Thursday, June 24, 2010 11:31 AM
To: [email-masked]
Subject: Re: [Cfrg] ECC Encryption questions

_______________________________________________
Cfrg mailing list
[email-masked]
http://www.irtf.org/mailman/listinfo/cfrg

---

From: "Blumenthal, Uri - 0668 - MITLL" <[email-masked]>
Date: Thu, 24 Jun 2010 15:02:50 -0400

As this is a Crypto RESEARCH forum - I think that even generic questions
about applicability and usability of various crypto mechanisms are
acceptable. (For those whose time is too valuable for that - Delete button
is on the right side of keyboard, and this list hasn't been flooded with
such threads.)

Especially in this case where it is clear that a "veteran" IETF participant
asked for a guidance in developing a standard related to his field of
expertise.

Come on, guys.

Oh, and a personal opinion - I think seeking modes based on non-SHA-[12]
hashes is both reasonable and useful.

---

From: Dan Brown <[email-masked]>
Date: Thu, 24 Jun 2010 15:08:08 -0400

I re-read the charter and agree that my question on hashless modes was out of scope for CFRG.  I will try to avoid such unfocused questions in the future.

Best regards,

Dan

-----Original Message-----

---------------------------------------------------------------------
This transmission (including any attachments) may contain confidential information, privileged material (including material protected by the solicitor-client or other applicable privileges), or constitute non-public information. Any use of this information by anyone other than the intended recipient is prohibited. If you have received this transmission in error, please immediately reply to the sender and delete this information from your system. Use, dissemination, distribution, or reproduction of this transmission by unintended recipients is not authorized and may be unlawful.

---

From: David McGrew <[email-masked]>
Date: Fri, 25 Jun 2010 13:18:24 -0700

Hi David,

I agree that "how does it work?" sorts of questions are out of scope  
(though I hope we'll be forgiving of the occasional question of that  
sort).

Questions like "can it do this?" could be in scope - we want to be a  
bridge between theory and practice, and we want that to work in both  
directions.   If there are real-world applications for which existing  
mechanisms are not suitable, it will be good to know.

I think the general topic of a minimal set of crypto primitives (e.g.  
can we make do with a hash and not a block cipher, or with a block  
cipher but not a hash) is a worthwhile topic.  Ideally, we should  
start with the basic requirements and work out from there.

David