Re: [Cfrg] Please review/comment on draft-moskowitz-hip-new-crypto-02

Glancing at
https://csrc.nist.gov/projects/lightweight-cryptography/round-2-candidates
(round 2 candidates), these use Keccak:

- Elephant (Keccak is one possible instantiation)
- ISAP

Other candidates based on sponges include:

- Ascon
- DryGASCON
- ORANGE
- SPIX
- SpoC
- Xoodyak (albeit inspired by Keccak, not Keccak itself)

If you were concerned about the absence of sponge-based constructions in
NIST's Lightweight Cryptography competition, I hope this puts your mind at
ease.

Scott Arciszewski
Chief Development Officer
Paragon Initiative Enterprises <https://paragonie.com>

On Thu, Oct 3, 2019 at 12:18 PM John Mattsson <john.mattsson=
40ericsson.com@dmarc.ietf.org> wrote:

> Interesting! Specifing some AEAD based on Keccac seems to make sense.
>
>
>
> I noted that Keyak was not chosen in the CEASAR final portfolio, do anyone
> know why? I cannot find any report from the
>
> CEASAR competition…..
>
>
>
> Are any Keccac based ciphers submitted to the NIST's lightweight crypto
> competition? If I remember correctly NIST was previously talking about
> standardizing a Keccac based AEAD, but I have not seen any info on that for
> a while.
>
>
>
> Cheers,
>
> John
>
>
>
> *From: *Cfrg <cfrg-bounces@irtf.org> on behalf of Robert Moskowitz <
> rgm-sec@htt-consult.com>
> *Date: *Thursday, 3 October 2019 at 17:47
> *To: *"cfrg@irtf.org" <cfrg@irtf.org>
> *Subject: *[Cfrg] Please review/comment on
> draft-moskowitz-hip-new-crypto-02
>
>
>
> This draft adds support of EdDSA, EC25519/EC448, and Keccak hashes and
> cipher (Keyak) to HIP (rfc 7401).
>
> The interest to this group, is I believe this is the 1st? major adoption
> of Keccak (FIPS 202, sp800-185, and sp800-56Cr1) in IETF drafts.
>
> KMAC vs HMAC is perhaps the simplest change.  It would seem that KMAC
> (sp800-185) is more efficient than HMAC and might be of advantage to high
> capacity situations.
>
> Then there is the KDF based on sp800-56Cr1 (called KEYMAT in HIP lingo).
> This is a significant change from RFC5869 and sp800-108.  But I have
> assurances? that it meets the needed strength requirements.
>
> Finally I am perhaps 'jumping the gun' on NIST's lightweight crypto
> competition with specifying Keyak, but for a constrained device developer,
> it means one underlying engine to support.
>
> TBD is a separate draft to amend RFC7402 to add Keyak to HIP's use of ESP
> (and include diet-ESP).
>
> The only 'hidden' gotcha is EdDSA25519 using SHA512 rather than a
> cSHAKE256 with 512 bits output (see KEYMAT above).  This has code-size
> implications to constrained system developers.  Otherwise it is all 'new'
> crypto.
>
> ======================================
>
> A new version of I-D, draft-moskowitz-hip-new-crypto-02.txt
>
> has been successfully submitted by Robert Moskowitz and posted to the
>
> IETF repository.
>
>
>
> Name:            draft-moskowitz-hip-new-crypto
>
> Revision: 02
>
> Title:           New Cryptographic Algorithms for HIP
>
> Document date:   2019-10-03
>
> Group:           Individual Submission
>
> Pages:           12
>
> URL:            https://www.ietf.org/internet-drafts/draft-moskowitz-hip-new-crypto-02.txt <https://protect2.fireeye.com/url?k=f5f3e143-a97a3b6f-f5f3a1d8-0cc47ad93da2-a719c860baead1e6&q=1&u=https%3A%2F%2Fwww.ietf.org%2Finternet-drafts%2Fdraft-moskowitz-hip-new-crypto-02.txt>
>
> Status:         https://datatracker.ietf.org/doc/draft-moskowitz-hip-new-crypto/ <https://protect2.fireeye.com/url?k=fffb3b7c-a372e150-fffb7be7-0cc47ad93da2-78d83682ccfc8b3a&q=1&u=https%3A%2F%2Fdatatracker.ietf.org%2Fdoc%2Fdraft-moskowitz-hip-new-crypto%2F>
>
> Htmlized:       https://tools.ietf.org/html/draft-moskowitz-hip-new-crypto-02 <https://protect2.fireeye.com/url?k=f062eb91-aceb31bd-f062ab0a-0cc47ad93da2-22cb8134989de627&q=1&u=https%3A%2F%2Ftools.ietf.org%2Fhtml%2Fdraft-moskowitz-hip-new-crypto-02>
>
> Htmlized:       https://datatracker.ietf.org/doc/html/draft-moskowitz-hip-new-crypto <https://protect2.fireeye.com/url?k=5d6da924-01e47308-5d6de9bf-0cc47ad93da2-5e91e8000092fe70&q=1&u=https%3A%2F%2Fdatatracker.ietf.org%2Fdoc%2Fhtml%2Fdraft-moskowitz-hip-new-crypto>
>
> Diff:           https://www.ietf.org/rfcdiff?url2=draft-moskowitz-hip-new-crypto-02 <https://protect2.fireeye.com/url?k=d7be9813-8b37423f-d7bed888-0cc47ad93da2-ef6e3ea349ba4e7c&q=1&u=https%3A%2F%2Fwww.ietf.org%2Frfcdiff%3Furl2%3Ddraft-moskowitz-hip-new-crypto-02>
>
>
>
> Abstract:
>
>    This document provides new cryptographic algorithms to be used with
>
>    HIP.  The Edwards Elliptic Curve and the Keccak sponge functions are
>
>    the main focus.  The HIP parameters and processing instructions
>
>    impacted by these algorithms are defined.
>
>
>
>
>
>
>
>
>
> Please note that it may take a couple of minutes from the time of submission
>
> until the htmlized version and diff are available at tools.ietf.org.
>
>
>
> The IETF Secretariat
>
>
>
>
>
> _______________________________________________
> Cfrg mailing list
> Cfrg@irtf.org
> https://www.irtf.org/mailman/listinfo/cfrg
>