Subject: [Cfrg] CFRG Crypto Panel review: draft-krovetz-ocb-wideblock-00

From: Yaron Sheffer <[email-masked]>
Date: Sun, 24 Mar 2019 19:31:36 +0200

Summary: this review was taken at the request of the ISE. He asked
that we pick one of:

1) this is a good idea and should be taken by CFRG

2) this is a good idea and should be published in the Independent
Stream

3) this is a good idea, but needs some fixes

4) this is not a good idea and should not be published.

Unfortunately I have to pick yet another response:

5) this is NOT a good idea, but if published, it should be published
by CFRG and not ISE.

Details

This is version -00 of the draft and it has had no review or
discussion on the list. For all I know, my review will be the first
one (although the acknowledgments seem to refer to some off-list
discussions). The level of complexity and depth of the review needed
IMO means that publishing in the Independent Stream would be very
risky (major security risks may be lurking that would have been
uncovered by more review), so I do NOT recommend to publish at the
ISE.

OCB is defined in RFC 7253 (BTW, the reference in the I-D is
incorrect), and this is a minor extension to it. The IPR situation
was murky when RFC 7253 was published and remains murky to this day.
However since OCB itself was published, and since I don't see any
IPR issues that are specific to wideblock variants, I don't see IPR
as a reason not to publish.

However, it is unclear to me why this draft is needed by the
industry: nobody today wants blockciphers with a block size smaller
than 128; and nobody (almost nobody?) uses blockciphers with a block
size larger than 128. The document itself does not present any
specific motivation, as in "we would like to use the X wide-block
cipher because...". The cipher mentioned in the draft, RC6, is
itself exotic and rarely if ever used in practice and again, it is
unclear what the CFRG audience would gain by its publication.

All in all, I would strongly recommend for the ISE not to publish
this document. In addition, my personal opinion is that this work
would not be a good use of the CFRG energy either.