[secdir] Secdir last call review of draft-ietf-lamps-pkix-shake-08

Yoav Nir via Datatracker <noreply@ietf.org> Sun, 31 March 2019 20:02 UTC

Return-Path: <noreply@ietf.org>
X-Original-To: secdir@ietf.org
Delivered-To: secdir@ietfa.amsl.com
Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 12E7912008A; Sun, 31 Mar 2019 13:02:08 -0700 (PDT)
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
From: Yoav Nir via Datatracker <noreply@ietf.org>
To: <secdir@ietf.org>
Cc: spasm@ietf.org, ietf@ietf.org, draft-ietf-lamps-pkix-shake.all@ietf.org
X-Test-IDTracker: no
X-IETF-IDTracker: 6.94.1
Auto-Submitted: auto-generated
Precedence: bulk
Reply-To: Yoav Nir <ynir.ietf@gmail.com>
Message-ID: <155406252797.12369.12070204875103995275@ietfa.amsl.com>
Date: Sun, 31 Mar 2019 13:02:08 -0700
Archived-At: <https://mailarchive.ietf.org/arch/msg/secdir/1I5OeVGTm0ZF80GjgW2hNmqD2t4>
Subject: [secdir] Secdir last call review of draft-ietf-lamps-pkix-shake-08
X-BeenThere: secdir@ietf.org
X-Mailman-Version: 2.1.29
List-Id: Security Area Directorate <secdir.ietf.org>
List-Archive: <https://mailarchive.ietf.org/arch/browse/secdir/>
List-Post: <mailto:secdir@ietf.org>
X-List-Received-Date: Sun, 31 Mar 2019 20:02:08 -0000

Reviewer: Yoav Nir
Review result: Has Issues

I have reviewed this document as part of the security directorate's ongoing

The document is almost ready. The intent is clear and the IANA instructions are

I have two issues with the Security Considerations section.  That section has
two paragraphs, and I'll start with the second one.

The second paragraph has a SHOULD-level requirement to choose an ECDSA curve
with an appropriate strength to match that of the hash function (SHAKE128 vs
SHAKE256). This seems to me like a compliance requirement. While this is not a
hard-and-fast rule, these should usually go in the body of the document, such
as in section 5 rather than in security considerations.  It's also puzzling why
there are no similar recommendations for the strength of the RSA key.

The first paragraph I find confusing.  It states that the SHAKE functions are
deterministic, and goes on to explain that this means that executing them on
the same input will result in the same output, and that users should not expect
this to be the case. Why does this need to be said? Is this not the same for
any hash function? The paragraph than goes on to tell the reader that  with
different output lengths, the shorter ones are prefixes of the longer ones, and
that this is like hash function truncation.  Why do we need any of this
information and why is this related to security?  This is especially puzzling
considering that the document fixes the output length to a specific value for
each of the two functions.