Subject: Re: [Uta] FW: New Version Notification for draft-ietf-uta-rfc7525bis-05.txt

From: "Salz, Rich" <[email-masked]>
Date: Thu, 3 Feb 2022 19:47:32 +0000

I re-read the document.  It's very nice.  A few nits, I think all are editorial and can be fixed later. I support moving this doc forward.

I note that you say "use encrypted client hello when it's ready"  Do you want to make the same recommendation for DTLS 1.3?

Do you want to say anything about EdDSA and the kerfuffle going on in cfrg@ mailing list right now?  No is a good, and probably sane, answer.

4.3 needs a tweak to get {RFC8446, Section 9.1} right.

4.4, do you want to say why 2**24.5 is used for both?  Simpler and therefore easier to get right?

5. Should the applicability statement include things like QUIC and NTS?

5. Rather than refer to 2026, I think you should refer to the BCP whatever it is.

6.1 Should the references to RFC6125 be changed to the draft 6125bis?

---

From: Yaron Sheffer <[email-masked]>
Date: Fri, 04 Feb 2022 18:54:07 +0200

Hi Rich,

Thanks for re-reading the draft. Below are some answers to your questions - note that we haven't discussed them as a team and my co-authors may well disagree.

Best,
	Yaron

On 2/3/22, 21:47, "Salz, Rich" <[email-masked]> wrote:

Yes, we probably should.

No. We discussed it briefly and although we added 25519 for the ECDH key exchange, we are not recommending (or even discussing) the use of EdDSA for signatures or certs. So there's nowhere to even include such a comment.

Yes.

Good question, we would need to discuss it.

Indeed.

You and Peter know best.

---

From: "Salz, Rich" <[email-masked]>
Date: Fri, 4 Feb 2022 17:05:42 +0000

Your answers all make sense.  I think 6125bis is more appropriate than 6125, but that would probably mainly depend on publication schedule.

>    You and Peter know best.

Do you mind if I show that to my wife? :)

---

From: "Valery Smyslov" <[email-masked]>
Date: Mon, 7 Feb 2022 10:55:54 +0300

Hi Yaron,

[snipped]

> No. We discussed it briefly and although we added 25519 for the ECDH key exchange, we are not
> recommending (or even discussing) the use of EdDSA for signatures or certs. So there's nowhere to even
> include such a comment.

The discussion in CFRG was not about EdDSA specifically, but about fault attacks on other deterministic signature
schemes, including deterministic ECDSA. The draft currently recommends using deterministic ECDSA (as specified in RFC6979) 
over the classic one, so we seem to explicitly recommend what cryptographers express concerns of.

On the other hand, it seems to me that "fault attacks" are outside Dolev-Yao model, so I'm not sure
how relevant their concerns are in the context of the draft.

Regards,
Valery.

---

From: Yaron Sheffer <[email-masked]>
Date: Mon, 07 Feb 2022 16:25:47 +0200

Hi Yaron,

    [snipped]

    Regards,
    Valery.

Hi Valery,

You are right about det-ECDSA and this is a very good question. IMO some side-channel attacks are relevant to the generic Internet model and some are not (even if all of them are outside the Dolev-Yao model). Timing oracle attacks can be initiated remotely and therefore are addressed by mechanisms that we recommend in RFC 7525. OTOH fault attacks have much more limited applicability and so we don't discuss them.

Thanks,
	Yaron