Re: [Cfrg] RGLC on draft-irtf-cfrg-kangarootwelve-01

[Dan Brown <[e-mail]>]

I have not studied this draft, so I do not oppose it, but I am quite puzzled by the motivation.

 

It may be too late now to ask for explanations that would unpuzzle (only) me: they were probably discussed during the call for adoption.  If so, please disregard the rest of the message.

 

***

 

Background:

 

My understanding, which I expect is simplistic, is that this (K12) is a fast variable length hash (XOF) which uses fewer rounds than the existing NIST XOF (or similar constructs).

 

For sake of argument, let us assume K12 is secure, and it has merit of being faster than some alternatives, especially NIST XOF.

 

General questions, with some details:

 

1.	CFRG or NIST?

 

Isn’t NIST also running a lightweight crypto (LWC) project?  Are some algorithms there even faster than Kangaroo12?

 

But CFRG decided to wait for NIST PQC, so why would CFRG try to race with NIST LWC?

 

I could guess that an answer is that NIST PQC is a matter of security, but NIST LWC is a matter of efficiency, so is more fair game for CFRG?  But maybe there’s a better answer.

 

2.	Too many solutions to the same problem?

 

The more options in a system, meaning solutions to a problem, in this case, variable-length hashing, has some downsides, such as adversaries negotiating the weakest option.

 

There are mitigation (secure negotiation), and upsides: agility (reacting to attacks) and compounds (defense in depth).

 

Perhaps, this draft or the CFRG should address this larger issue.

 

3.	Is this a solution looking for a problem?

 

Sorry to use the bad cliché above, but is there a real world use case where K12 works, but the alternatives do not?  Or is it just a generic strategy to choose optimal efficiency for a given security?

​​​​​

Dan Brown

BlackBerry

 

From: Cfrg <[e-mail]> On Behalf Of Alexey Melnikov
Sent: Sunday, February 16, 2020 6:16 AM
To: [e-mail]
Subject: [Cfrg] RGLC on draft-irtf-cfrg-kangarootwelve-01

 

Dear CFRG participants,

This message is starting 2 weeks RGLC on draft-irtf-cfrg-kangarootwelve-01 ("KangarooTwelve"), that will end on March 1st 2020. If you've read the document and think that it is ready (or not ready) for publication as an RFC, please send a message in reply to this email or directly to CFRG chairs ([e-mail] <mailto:[e-mail]> ). If you have detailed comments, these would also be very helpful at this point.





Thank you,

Alexey, for CFRG chairs.

----------------------------------------------------------------------
This transmission (including any attachments) may contain confidential information, privileged material (including material protected by the solicitor-client or other applicable privileges), or constitute non-public information. Any use of this information by anyone other than the intended recipient is prohibited. If you have received this transmission in error, please immediately reply to the sender and delete this information from your system. Use, dissemination, distribution, or reproduction of this transmission by unintended recipients is not authorized and may be unlawful.