Re: [Cfrg] [secdir] ISE seeks help with some crypto drafts

[Paul Wouters <[e-mail]>]

On Fri, 8 Mar 2019, RFC ISE (Adrian Farrel) wrote:

> Hi CFRG and SecDir,
>
> Ted Krovetz has asked for publication of ...
>
> https://datatracker.ietf.org/doc/draft-krovetz-ocb-wideblock/
> ....and...
> https://datatracker.ietf.org/doc/draft-krovetz-rc6-rc5-vectors/
>
> ....in the Independent Stream.
>
> These are both currently in expired state, but available in the archive.
>
> At this stage I am looking to know whether anyone feels that publication
> would be a bad thing:
> - at this stage
> - ever

I have strong reservations about the ocb draft. Rogaway has patents
on OCB, and has put constrains on its use and there is no generic IPR
statement that the IETF normally likes to see for work published as
RFC. Until such a time, I do not think publishing RFC's with OCB is
advised. A few years ago I asked the TLS OCB authors about extending
their allowed usage to IKE/IPsec and they told me this use was not
covered by Rogaway's license to them. While this has since changed a bit,
and there is no longer a specific TLS-only license, other constrains are
still in place.  Specifying OCB documents that cannot be implemented or
deployed indiscriminatory is troublesome.

Patents:
http://www.cs.ucdavis.edu/~rogaway/ocb/ocb-faq.htm#patent:phil

 	"I license OCB under fair, reasonable, and non-discriminatory terms,
 	 with licensees paying a modest one-time fee."

 	"I freely license OCB for most (but not all) settings."

And just before that, discriminatory terms are cited for current use:

 	"there is one license grant for open-source software; one for
 	 non-military software; and a third done just for OpenSSL."


See also http://web.cs.ucdavis.edu/~rogaway/ocb/offer.htm

Second, I'm not a cryptographer, but it seems OCB has recently seen some
attacks that might impact the security of OCB:

Cryptanalysis of OCB2
https://eprint.iacr.org/2018/1040

Breaking the confidentiality of OCB2
https://eprint.iacr.org/2018/1087

Plaintext Recovery Attack of OCB2
https://eprint.iacr.org/2018/1090

Note these publications are newer than the publication date of the
draft, so it would be good to discuss this with the draft author or
with CFRG to see how applicable these attacks are to the draft document.

I have no specific remarks about the rc5-rc6 document. It seems useful
to have test vectors, but I am not aware of any IETF protocol using
RC5 or RC6, in which case it might not make sense for the IETF to publish
these test vectors and another standards body might be more appropriate.

Paul