Re: [CFRG] IRTF Chair review of draft-irtf-cfrg-frost-12

[Christopher Wood <[e-mail]>]

Hi Colin,

All IPR disclosures have been made. I just forwarded you the individual messages that have them; sorry for the burst of email! We also just cut a new version of the draft that should address your comments.

Please let us know if anything else is required to move this forward in the process.

Best,
Chris

> On Apr 13, 2023, at 2:06 PM, Colin Perkins <[e-mail]> wrote:
> 
> The CFRG chairs have requested that draft-irtf-cfrg-frost-12 be published as an RFC on the IRTF stream. The IRTF publication process is described in RFC 5743, and comprises a review by the IRSG to ensure technical and editorial quality, followed by a check by the IESG to ensure the work does not conflict with IETF standards activities.
> 
> As IRTF Chair, I perform an initial review of all drafts submitted for publication on the IRTF stream before sending them for detailed review by the IRSG. This note provides my review comments, for discussion.
> 
> Authors, please can you also respond to this message to confirm that all necessary IPR disclosures, as described on https://irtf.org/policies/ipr, have been made? (Or if the chairs have already confirmed this, please send details)
> 
> Result:
> * Ready with nits
> 
> RFC 5743 compliance:
> * The draft follows the guidelines in RFC 5743
> 
> Comments:
> 
> Thank you for this well written draft. I have some nits below that I would ask the authors to consider. Otherwise, this looks good to progress once we have confirmation about the IPR.
> 
> 	• The formatting of the function definitions is inconsistent. Some of the early definitions, for example in Section 4.1 nonce_generate(secret) are written with a function signature, the Inputs, the Outputs, then def nonce_generate(secret):. In the later sections, the initial function signature is missing. The draft would be improved if the formatting of these definitions was consistent.
> 
> 	• Section 5.1: the description of the output “(nonce, comm), a tuple of nonce and nonce commitment pairs” is confusing since it looks like a single tuple is returned, rather than a tuple of tuples. Maybe “((hiding_none, binding_none), (hiding_nonce_comm, binding_nonce_comm))”?
> 
> 	• Section 6: there are a large number of numeric parameters in this section. I trust that the values in the draft have been carefully compared against a reference implementation?
> 
> 	• Section 6.6: “All hash functions MUST be domain separated with a per-suite context string” but FROST(Ed25519, SHA-512) does not, for compatibility. Can you clarify why this is not problematic (presumably it’s okay provided all other hash functions are domain separated)
> 
> Regards,
> Colin
>