Subject: [Cfrg] CFRG Crypto Panel review: draft-krovetz-rc6-rc5-vectors-00

From: Yaron Sheffer <[email-masked]>
Date: Sun, 24 Mar 2019 19:28:21 +0200

Summary: this review was taken at the request of the ISE. He asked
that we pick one of:

1) this is a good idea and should be taken by CFRG

2) this is a good idea and should be published in the Independent
Stream

3) this is a good idea, but needs some fixes

4) this is not a good idea and should not be published.

I would pick #4, this is not a good idea. Formally, the document
lists test vectors for algorithms that are not properly
standardized. Pragmatically, I see no industry demand or need for
these two algorithms to be standardized today.

Details:

- RC5 is not used by any Internet protocols, to the best of my
knowledge, although it is specified for a few, e.g. ESP. It is
defined by the old RFC 2040 (published back in 1996, when we still
used to have 40-bit "export" keys, and cited by very few documents
since).

- RFC 2040 actually does have test vectors.

- For some reason RFC 2040 is cited as an informative, not a
normative reference for RC5.

- The I-D does not cite any standard as the authoritative reference
for RC6 (a patent does not count, and Google does not find the cited
normative reference). This seems to me a prerequisite before we can
publish test vectors. The document refers to the algorithms'
"specifications" and I fail to understand what this means, in the
case of RC6. Wikipedia has a link to a paper on Ron Rivest's web
page as their best authority. Academic papers on cryptographic
protocols are not anywhere near a formal standard, as far as
supporting implementors.

- The document makes security recommendations on how the algorithms
should be used, by including recommended parameter sets. This is
very good, but belongs in a normative specification of the algorithm
rather than a document that lists test vectors.

- The first RC6 test vector uses a 32-bit key, and the second a
64-bit key. Both of which are not acceptable nowadays. Similarly for
RC5.

- Another test vector is missing the key, which I assume is a typo.