Re: [Cfrg] On the (non-)randomness of the S-box of Streebog and Kuznyechik

["Stanislav V. Smyshlyaev" <[e-mail]>]

Dear Stephen,

>> So that sounds like an erratum may be worthwhile for each of 8624 and
7901? I guess the code points defined for DNSSEC are really for the old
algorithms and ought not point to the RFCs for the new ones?
>> And that hasn't really got anything to do with the meat of Leo's
findings - it's just that his work flagged up the erroneous references.
Personally, I agree that it would be good to do the updates here. But, as
for DNSSEC, I hope that the authors of RFC 5933 (or, maybe, Dmitry
Belyavsky) can comment better.



вт, 6 авг. 2019 г. в 16:33, Stephen Farrell <[e-mail]>:

>
> Hiya,
>
> On 06/08/2019 14:14, Stanislav V. Smyshlyaev wrote:
> > Stephen, GOST R 34.11-94 is built using a completely different
> > construction, so (Leo will correct me, if I am mistaken) the discovered
> > properties are not related to GOST R 34.11-94. I’d also like to clarify
> > that this GOST R 34.11-94 is an old hash function, which has been
> > deprecated for about 7 years in Russia.
>
> So that sounds like an erratum may be worthwhile
> for each of 8624 and 7901? I guess the code points
> defined for DNSSEC are really for the old algorithms
> and ought not point to the RFCs for the new ones?
> Those'd be valid errata I reckon, as it was a bit
> of a mistake (though entirely understandable) to
> refer to the new RFCs when the code points are for
> the old algorithms. Those errata would just say
> that the normative references to the new RFC were
> wrong and should've been to the old RFC. And that
> hasn't really got anything to do with the meat of
> Leo's findings - it's just that his work flagged
> up the erroneous references.
>
> As to whether to deprecate the algorithms due to
> Leo's findings, I agree that the existence of
> deployments that'd be affected needs to be taken
> into account in terms of the timing of when that
> might reasonably be done. And the fact that the
> algorithms in question are national standards is
> also a relevant point, though of course deprecating
> the RFCs has no formal effect on such national
> standards.
>
> Personally though, I think discovery of undeclared
> and unexplained structure such as this in a crypto
> algorithm ought be taken as a negative, even if there
> is no known attack at present, so I'd be for moving
> to deprecate when that is practical, in this case,
> as I would in any other similar case.
>
> Cheers,
> S.
>