[Cfrg] CFRG Crypto Panel review: draft-krovetz-ocb-wideblock-00

[Yaron Sheffer <[e-mail]>]

Summary: this review was taken at the request of the ISE. He asked that we pick one of:

1) this is a good idea and should be taken by CFRG
2) this is a good idea and should be published in the Independent Stream
3) this is a good idea, but needs some fixes
4) this is not a good idea and should not be published.

Unfortunately I have to pick yet another response:

5) this is NOT a good idea, but if published, it should be published by CFRG and not ISE.

Details

This is version -00 of the draft and it has had no review or discussion on the list. For all I know, my review will be the first one (although the acknowledgments seem to refer to some off-list discussions). The level of complexity and depth of the review needed IMO means that publishing in the Independent Stream would be very risky (major security risks may be lurking that would have been uncovered by more review), so I do NOT recommend to publish at the ISE.

OCB is defined in RFC 7253 (BTW, the reference in the I-D is incorrect), and this is a minor extension to it. The IPR situation was murky when RFC 7253 was published and remains murky to this day. However since OCB itself was published, and since I don't see any IPR issues that are specific to wideblock variants, I don't see IPR as a reason not to publish.

However, it is unclear to me why this draft is needed by the industry: nobody today wants blockciphers with a block size smaller than 128; and nobody (almost nobody?) uses blockciphers with a block size larger than 128. The document itself does not present any specific motivation, as in "we would like to use the X wide-block cipher because...". The cipher mentioned in the draft, RC6, is itself exotic and rarely if ever used in practice and again, it is unclear what the CFRG audience would gain by its publication.

All in all, I would strongly recommend for the ISE not to publish this document. In addition, my personal opinion is that this work would not be a good use of the CFRG energy either.