Re: [Cfrg] On the (non-)randomness of the S-box of Streebog and Kuznyechik

[Stephen Farrell <[e-mail]>]

Hiya,

On 06/08/2019 15:09, Dmitry Belyavsky wrote:
> Dear Stephen,
> 
> RFC 7091 seems to be a translation of the corresponding GOST standard.
> 
> RFC 8624 contains a reference to RFC5933, where the GOST algorithms for
> DNSSec were introduced.
> The reference is correct, the reference to the superseding algorithms is
> correct too.

I'm not getting it. Why does 8624 need a normative
reference to 6986 and an informative reference to
5933 when the code points refer to the algorithms
defined in 5933?

S.

> 
> So it seems that no errata required here.
> 
> 
> On Tue, Aug 6, 2019 at 4:56 PM Stanislav V. Smyshlyaev <[e-mail]>
> wrote:
> 
>> Dear Stephen,
>>
>>>> So that sounds like an erratum may be worthwhile for each of 8624 and
>> 7901? I guess the code points defined for DNSSEC are really for the old
>> algorithms and ought not point to the RFCs for the new ones?
>>>> And that hasn't really got anything to do with the meat of Leo's
>> findings - it's just that his work flagged up the erroneous references.
>> Personally, I agree that it would be good to do the updates here. But, as
>> for DNSSEC, I hope that the authors of RFC 5933 (or, maybe, Dmitry
>> Belyavsky) can comment better.
>>
>>
>>
>> вт, 6 авг. 2019 г. в 16:33, Stephen Farrell <[e-mail]>:
>>
>>>
>>> Hiya,
>>>
>>> On 06/08/2019 14:14, Stanislav V. Smyshlyaev wrote:
>>>> Stephen, GOST R 34.11-94 is built using a completely different
>>>> construction, so (Leo will correct me, if I am mistaken) the discovered
>>>> properties are not related to GOST R 34.11-94. I’d also like to clarify
>>>> that this GOST R 34.11-94 is an old hash function, which has been
>>>> deprecated for about 7 years in Russia.
>>>
>>> So that sounds like an erratum may be worthwhile
>>> for each of 8624 and 7901? I guess the code points
>>> defined for DNSSEC are really for the old algorithms
>>> and ought not point to the RFCs for the new ones?
>>> Those'd be valid errata I reckon, as it was a bit
>>> of a mistake (though entirely understandable) to
>>> refer to the new RFCs when the code points are for
>>> the old algorithms. Those errata would just say
>>> that the normative references to the new RFC were
>>> wrong and should've been to the old RFC. And that
>>> hasn't really got anything to do with the meat of
>>> Leo's findings - it's just that his work flagged
>>> up the erroneous references.
>>>
>>> As to whether to deprecate the algorithms due to
>>> Leo's findings, I agree that the existence of
>>> deployments that'd be affected needs to be taken
>>> into account in terms of the timing of when that
>>> might reasonably be done. And the fact that the
>>> algorithms in question are national standards is
>>> also a relevant point, though of course deprecating
>>> the RFCs has no formal effect on such national
>>> standards.
>>>
>>> Personally though, I think discovery of undeclared
>>> and unexplained structure such as this in a crypto
>>> algorithm ought be taken as a negative, even if there
>>> is no known attack at present, so I'd be for moving
>>> to deprecate when that is practical, in this case,
>>> as I would in any other similar case.
>>>
>>> Cheers,
>>> S.
>>>
>>
>