Re: [CFRG] Adoption Call: Guidelines for Writing Cryptography Specifications

[Kai Mindermann <[e-mail]>]

Hi,

I like the idea and the approach! Thanks and already looking forward to the next draft 😊

Here are my first thoughts on it:

  *   Many of the guidelines/tips are very high-level and general and good! Yet, they lack concrete dos and don’ts like examples. (Yes, there is an overall example of ONE good RFC and ONE not so good one 😉)
  *   Also, the structuring is a lot of text. Bullet points for things to DO and things NOT to do would make it faster to go through or copy paste into a new draft as TODO items, like a checklist
  *   In general the tips are useful but can be more useful if they don’t leave decisions to think about:
     *   E.g. “Establish a consistent terminology: Develop a clear and consistent set of terms and definitions that will be used throughout the document.”
     *   =>
     *   Use terms exactly with the meaning defined in: RFC4949 and (etc, other standards that defined terminology). Only define a term differently if you absolutely need to.
  *   One of the biggest obstacles for implementation is the parameter choices. I’d like to see a section in every crypto algorithm RFC devoted to only that. Like what are the input parameters and how do I choose them. Especially providing reasonable default sets of parameters. (As its especially difficult to understand the relation and influences of one parameter choice on the others).
  *   This also leads to specifying the corresponding standardized algorithm and parameter identifiers like for example for CBOR, TLS etc. Like there shouldn’t be a separate specification for adding those sets to an IANA registry after the fact, it should be included right with the algorithm description. Experts can still choose what they want, but this would make implementation much easier and more secure from the source of this algorithm, the specification. Preventing all the other blog posts and “documentation” that will get the combination/choice of parameters wrong.

CBOR Object Signing and Encryption (COSE)<https://www.iana.org/assignments/cose/cose.xhtml>

AEAD Algorithms<https://www.iana.org/assignments/aead-parameters/aead-parameters.xhtml>

Named Information Hash Registry<https://www.iana.org/assignments/named-information/named-information.xhtml#hash-alg>

https://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml#tls-parameters-4



  *   Maybe a single registry would be nice, but not achievable because of the different use cases….
  *   Maybe a template for a cryptography RFC would be a separate output of work on this RFC 😊

A hint to the authors, you can have a look for more concrete formulations of previous ideas in the draft for the Secure Crypto Config: https://datatracker.ietf.org/doc/draft-kaimindermann-securecryptoconfig/

[RFC4949]
Shirey, R., "Internet Security Glossary, Version 2", FYI 36, RFC 4949, DOI 10.17487/RFC4949, August 2007, <https://www.rfc-editor.org/info/rfc4949>


Mit freundlichen Grüßen / Best regards
Kai Mindermann

--
Kai Mindermann
Senior Consultant, Technology Strategist
M [phone]

[e-mail]<mailto:[e-mail]>
www.ic-consult.com<https://www.ic-consult.com/>

iC Consult Gesellschaft für Systemintegration und Kommunikation mbH
Standort: Zettachring 8a | 70567 Stuttgart | Germany
Verwaltung: Huyssenallee 99-103 | 45128 Essen | Germany
Geschäftsführer: Dr. Andreas Neumann
HRB 116170 Amtsgericht München

Von: CFRG <[e-mail]> Im Auftrag von Stanislav V. Smyshlyaev
Gesendet: Freitag, 2. Juni 2023 07:14
An: <[e-mail]> <[e-mail]>
Cc: [e-mail]
Betreff: [CFRG] Adoption Call: Guidelines for Writing Cryptography Specifications

Dear CFRG participants,

This message is starting 3 weeks adoption call on "Guidelines for Writing Cryptography Specifications" draft, draft-sullivan-cryptography-specification-00 (https://datatracker.ietf.org/doc/draft-sullivan-cryptography-specification/) that will end on June 23rd 2023.

Please send your feedback in reply to this email or directly to CFRG chairs <[e-mail]><mailto:[e-mail]>.

Best regards,
Stanislav (for CFRG chairs)