Subject: [COSE] Call for Consensus: Standalone Hash Algorithms Document

From: "Matthew A. Miller" <[email-masked]>
Date: Mon, 25 Feb 2019 17:15:47 -0700

This messages starts a call for consensus to separate the COSE hash
algorithms into a separate document, ending on 2018-03-10.

In the virtual interim on 02-15, it was proposed to separate them from
draft-ietf-cose-x509, to allow the hash algorithm registrations to
stabilize more quickly than the rest of the X.509 draft.  If the working
group agrees with separating the algorithms, then a document will be
published that consists of Section 4 (Hash Algorithm Identifiers) and
Section 5.3 (COSE Algorithm Registry) from draft-ietf-cose-x509.

Please respond with whether or not you support separating the hash
algorithms into a separate document.  If you do not support this, please
indicate why not.

- Ivaylo and Matthew
COSE Chairs

---

From: Mike Jones <[email-masked]>
Date: Tue, 26 Feb 2019 00:26:58 +0000

Fine with me.

				-- Mike

-----Original Message-----
From: COSE <[email-masked]> On Behalf Of Matthew A. Miller
Sent: Monday, February 25, 2019 4:16 PM
To: cose <[email-masked]>
Subject: [COSE] Call for Consensus: Standalone Hash Algorithms Document

This messages starts a call for consensus to separate the COSE hash algorithms into a separate document, ending on 2018-03-10.

In the virtual interim on 02-15, it was proposed to separate them from draft-ietf-cose-x509, to allow the hash algorithm registrations to stabilize more quickly than the rest of the X.509 draft.  If the working group agrees with separating the algorithms, then a document will be published that consists of Section 4 (Hash Algorithm Identifiers) and Section 5.3 (COSE Algorithm Registry) from draft-ietf-cose-x509.

Please respond with whether or not you support separating the hash algorithms into a separate document.  If you do not support this, please indicate why not.

- Ivaylo and Matthew
COSE Chairs

---

From: Jim Schaad <[email-masked]>
Date: Mon, 25 Feb 2019 16:38:58 -0800

A version of what this document would look like can be found here https://tools.ietf.org/html/draft-schaad-cose-hash-algs-01

Jim

> In the virtual interim on 02-15, it was proposed to separate them from draft-
> ietf-cose-x509, to allow the hash algorithm registrations to stabilize more
> quickly than the rest of the X.509 draft.  If the working group agrees with
> separating the algorithms, then a document will be published that consists of
> Section 4 (Hash Algorithm Identifiers) and Section 5.3 (COSE Algorithm
> Registry) from draft-ietf-cose-x509.
>

---

From: Kathleen Moriarty <[email-masked]>
Date: Mon, 25 Feb 2019 21:40:41 -0500

I support this as I believe it spurred from some messages from me to Jim.  Thank you for starting the work.

Best regards,
Kathleen 

Sent from my mobile device

> On Feb 25, 2019, at 7:38 PM, Jim Schaad <[email-masked]> wrote:
> 
> _______________________________________________
> COSE mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/cose

---

From: Carsten Bormann <[email-masked]>
Date: Tue, 26 Feb 2019 07:28:15 +0100

+1 for split out.

I’m reiterating my point that we want to have some older items in the registry (not necessarily in this particular document).  E.g., SHA-1.  So we would need to find a balance with the sentence "Algorithms that do not meet the security requirements of
      the community and the messages structures should not be
      registered.” in Section 16.11 of RFC 8152.  We do have a “deprecated” value for the “recommended" column…

Grüße, Carsten

> On Feb 26, 2019, at 01:38, Jim Schaad <[email-masked]> wrote:
>

---

From: Russ Housley <[email-masked]>
Date: Tue, 26 Feb 2019 10:03:35 -0500

Jim:

It would probably be easy to add SHAKE now.  The equivalent document for CMS is draft-ietf-lamps-cms-shakes.

Russ

---

From: Laurence Lundblade <[email-masked]>
Date: Tue, 26 Feb 2019 19:42:17 -0800

+1 

LL

> On Feb 25, 2019, at 10:28 PM, Carsten Bormann <[email-masked]> wrote:
> 
> +1 for split out.
>

---

From: Jim Schaad <[email-masked]>
Date: Wed, 27 Feb 2019 12:44:36 -0800

I am not sure that I completely agree with that.  

First adding SHAKE other than as a hash function would mean that this is not
a standalone hash algorithm document.  Second, I am not sure at this point
of all of the different varieties and locations where SHAKE should be added.

Hash Functions:  Do we have just the two versions or do we have a truncated
64-bit version as well.  Not sure about where the variant that had a small b
would fall in here, but for now it might just be ignored.

Signature Algorithms:  At this point I don't know if there would need to be
any RSA versions or not.  Not sure what to say about DH versions.  ECDSA
maybe makes some sense.

Message Authentication Algorithms:  Do we put in a KMAC here or not?

Key Derivation Functions:  Do we just do HMAC with a KMAC drop in here or
does NIST have a different recommended way to do KDF with SHAKE functions?
We should definitely be able to get rid of HMAC when doing this as SHAKE
already has length extension attacks solved.

Key Agreement Functions: Since you need to have a combined key agreement
algorithm and KDF for COSE, how many of these are we going to define.

Encryption and Key Wrap algorithms:  I sorta hope that this can be avoided
for now, but I know that there are some AEAD algorithms which are built
using Keccak as an underlying primitive and I am not personally ready to try
and figure out how it works, but it is something that might need to be
discussed here (and in CFRG).

Given that the object is to get the hash algorithm assignments done for the
SUIT developers, I am not sure that doing this work in this document makes
sense.  I will also note that the CMS work in LAMPS and CURDLE ignored the
issues of new KDFs w/ SHAKE entirely so that maybe groundbreaking work here.

Jim

> From: Russ Housley <[email-masked]>
> Sent: Tuesday, February 26, 2019 7:04 AM
> To: Jim Schaad <[email-masked]>
> Cc: cose <[email-masked]>
> Subject: Re: [COSE] Call for Consensus: Standalone Hash Algorithms
> Document
> 
> Jim:
> 
> > A version of what this document would look like can be found here
> > https://tools.ietf.org/html/draft-schaad-cose-hash-algs-01
> >
> > Jim
> >
> >
> >> In the virtual interim on 02-15, it was proposed to separate them
> >> from draft- ietf-cose-x509, to allow the hash algorithm registrations
> >> to stabilize more quickly than the rest of the X.509 draft.  If the
> >> working group agrees with separating the algorithms, then a document
> >> will be published that consists of Section 4 (Hash Algorithm
> >> Identifiers) and Section 5.3 (COSE Algorithm
> >> algorithms into a separate document.  If you do not support this,
> >> please indicate why not.
> >>
> >>
> >> - Ivaylo and Matthew
> >> COSE Chairs
> >
> >

---

From: Russ Housley <[email-masked]>
Date: Wed, 27 Feb 2019 15:54:22 -0500

Jim:

I as suggesting that SHAKE be added as a hash function.  Sure, it might be added to other documents as well, but I was not suggesting that.

Russ

> On Feb 27, 2019, at 3:44 PM, Jim Schaad <[email-masked]> wrote:
>

---

From: Jim Schaad <[email-masked]>
Date: Wed, 27 Feb 2019 18:09:25 -0800

I have much less of a problem with just doing the hashes.

So which SHAKE hashes do you think we should be defining?  To match SHA-2 it
would be SHAKE-128/64, SHAKE-128 and SHA-256. 

I don't know if there is a similar change in processing if you look at the
difference between 32 and 64 bit processors which can be found with the
SHA-2 implementations.  This lead to putting in the SHA-512/256 registration
that I put in the current draft.

Jim

> Sent: Wednesday, February 27, 2019 12:54 PM
> I as suggesting that SHAKE be added as a hash function.  Sure, it might be
> added to other documents as well, but I was not suggesting that.
> 
> Russ
> 
> 
> > First adding SHAKE other than as a hash function would mean that this
> > is not a standalone hash algorithm document.  Second, I am not sure at
> > this point of all of the different varieties and locations where SHAKE
should
> be added.
> >
> > Hash Functions:  Do we have just the two versions or do we have a
> > truncated 64-bit version as well.  Not sure about where the variant
> > that had a small b would fall in here, but for now it might just be
ignored.
> >
> > Signature Algorithms:  At this point I don't know if there would need
> > to be any RSA versions or not.  Not sure what to say about DH
> > versions.  ECDSA maybe makes some sense.
> >
> > Key Derivation Functions:  Do we just do HMAC with a KMAC drop in here
> > or does NIST have a different recommended way to do KDF with SHAKE
> functions?
> > We should definitely be able to get rid of HMAC when doing this as
> > SHAKE already has length extension attacks solved.
> >
> > Key Agreement Functions: Since you need to have a combined key
> > agreement algorithm and KDF for COSE, how many of these are we going
> to define.
> >
> > Encryption and Key Wrap algorithms:  I sorta hope that this can be
> > avoided for now, but I know that there are some AEAD algorithms which
> > are built using Keccak as an underlying primitive and I am not
> > personally ready to try and figure out how it works, but it is
> > something that might need to be discussed here (and in CFRG).
> >
> > Given that the object is to get the hash algorithm assignments done
> > for the SUIT developers, I am not sure that doing this work in this
> > document makes sense.  I will also note that the CMS work in LAMPS and
> > CURDLE ignored the issues of new KDFs w/ SHAKE entirely so that maybe
> groundbreaking work here.
> >
> >
> > Jim
> >
> >
> >>>> from draft- ietf-cose-x509, to allow the hash algorithm
> >>>> registrations to stabilize more quickly than the rest of the X.509
> >>>> draft.  If the working group agrees with separating the algorithms,
> >>>> then a document will be published that consists of Section 4 (Hash
> >>>> Algorithm

---

From: Russ Housley <[email-masked]>
Date: Thu, 28 Feb 2019 19:48:28 -0500

Jim:

Four object identifiers for SHAKE128 and SHAKE256 hash functions are defined by NIST [1]:

     id-shake128

     id-shake256

     id-shake128-len

     id-shake256-len

The first two have no parameters, and the second two have an output length parameter.

These are the ones that should probably be included in a COSE-friendly manner.

Russ

[1] https://csrc.nist.gov/Projects/Computer-Security-Objects-Register/Algorithm-Registration <https://csrc.nist.gov/Projects/Computer-Security-Objects-Register/Algorithm-Registration>

> On Feb 27, 2019, at 9:09 PM, Jim Schaad <[email-masked]> wrote:
>

---

From: Jim Schaad <[email-masked]>
Date: Thu, 28 Feb 2019 17:13:27 -0800

COSE does not support parameters so the later two cannot be supported by
themselves.  Rather a new code point would be assigned for a fixed parameter
set.  Thus we would need to decide what lengths should be supported for the
latter two options.

Jim

From: Russ Housley <[email-masked]> 
Sent: Thursday, February 28, 2019 4:48 PM
To: Jim Schaad <[email-masked]>
Cc: cose <[email-masked]>
Subject: Re: [COSE] Call for Consensus: Standalone Hash Algorithms Document

Jim:

Four object identifiers for SHAKE128 and SHAKE256 hash functions are defined
by NIST [1]:

     id-shake128

     id-shake256

     id-shake128-len

     id-shake256-len

The first two have no parameters, and the second two have an output length
parameter.

These are the ones that should probably be included in a COSE-friendly
manner.

Russ

[1]
https://csrc.nist.gov/Projects/Computer-Security-Objects-Register/Algorithm-
Registration

On Feb 27, 2019, at 9:09 PM, Jim Schaad <[email-masked]
<mailto:[email-masked]> > wrote:

Jim

-----Original Message-----
From: Russ Housley <[email-masked] <mailto:[email-masked]> >
Sent: Wednesday, February 27, 2019 12:54 PM
To: Jim Schaad <[email-masked] <mailto:[email-masked]> >
Cc: cose <[email-masked] <mailto:[email-masked]> >
Subject: Re: [COSE] Call for Consensus: Standalone Hash Algorithms
Document

Jim:

Russ

On Feb 27, 2019, at 3:44 PM, Jim Schaad <[email-masked]
<mailto:[email-masked]> > wrote:

should

be added.

ignored.

functions?

to define.

Jim

-----Original Message-----
From: Russ Housley <[email-masked] <mailto:[email-masked]> >
Sent: Tuesday, February 26, 2019 7:04 AM
To: Jim Schaad <[email-masked] <mailto:[email-masked]> >
Cc: cose <[email-masked] <mailto:[email-masked]> >
Subject: Re: [COSE] Call for Consensus: Standalone Hash Algorithms
Document

Jim:

It would probably be easy to add SHAKE now.  The equivalent document
for CMS is draft-ietf-lamps-cms-shakes.

Russ

On Feb 25, 2019, at 7:38 PM, Jim Schaad <[email-masked]
<mailto:[email-masked]> >

wrote:

Jim

-----Original Message-----
From: COSE <[email-masked] <mailto:[email-masked]> > On Behalf
Of Matthew A. Miller
Sent: Monday, February 25, 2019 4:16 PM
To: cose <[email-masked] <mailto:[email-masked]> >
Subject: [COSE] Call for Consensus: Standalone Hash Algorithms
Document

- Ivaylo and Matthew
COSE Chairs

_______________________________________________
COSE mailing list
[email-masked] <mailto:[email-masked]> 
https://www.ietf.org/mailman/listinfo/cose

_______________________________________________
COSE mailing list
[email-masked] <mailto:[email-masked]> 
https://www.ietf.org/mailman/listinfo/cose