Re: [Cfrg] I-D Action: draft-irtf-cfrg-randomness-improvements-08.txt

["Stanislav V. Smyshlyaev" <[e-mail]>]

Thanks, Riad!

The security analysis can be modified for HMAC instead of Signature without
significant problems, I suppose. And also several useful alternative
constructions can be proposed (based on HMAC or DH as an operation with a
key).
But this makes the scope of the I-D (initially motivated by TLS servers)
wider - a "menu of choices" of good solutions instead of one good solution.
If we want to do this, then, as it seems to me, the current process with an
I-D, which has already passed the RGLC and has moved to Waiting for
Document Shepherd stage, should be stopped and returned to the previous
stage of a work item before RGLC.

Personally, I really like the task of providing several good constructions
for "improving randomness" using various constructions - but I'm not sure
that it should be done in this document and not in a new one (Nick, Chris,
could you please share your opinion on this?..).

Best regards,
Stanislav



пт, 22 нояб. 2019 г. в 19:28, Riad S. Wahby <[e-mail]>:

> "Stanislav V. Smyshlyaev" <[e-mail]> wrote:
> > Yes, I believe that it can be a great future direction of work, but this
> > will be another construction, requiring additional security analysis
> etc. I
> > think that the topic of improving randomness will be always a very
> > important one, so a lot of other good ideas and good constructions may
> > arise in the future.
>
> I looked at the security analysis a while ago and although it's not
> fresh in my mind now, at the time I was convinced that the analysis
> applied almost directly to HMAC rather than a signature. Maybe I'm
> crazy, incompetent, or mis-remembering, though! :)
>
> As a more general point: the document's intro hints at this, but
> maybe it should be made more explicit that this protocol is geared
> towards the case where one's key is stored in an HSM. Sure, it works
> in other cases, but the choice to use signatures appears to be directly
> motivated by HSMs---otherwise, why not use a cheaper construction?
>
> -=rsw
>