Re: [Cfrg] RFC 5742 conflict review for draft-dolmatov-kuznyechik

[Simon Josefsson <[e-mail]>]

"Blumenthal, Uri - 0553 - MITLL" <[e-mail]> writes:

>>>Likewise, I’d expect an informational RFC describing Kalyna (Ukrainian
>>> contest winner), which looks somewhat more appealing.
>>
>>I see a problem with publishing descriptions of national ciphers without
>>guidance on suitable use and relevant applicability statements.
>
> The only guidance I see is: if you need "it" or are required to use "it" -
> do so, but be aware that people outside of your policy domain may not
> interoperate with you using “it” because they may not have “it”
> implemented. Implementing “it” is not required to be <whatever
> protocol>-compliant.

Where do you see this guidance?  I can't find anything like that in the
draft.  In fact the draft talks about itself as a Standard in several
places:

   The cryptographic algorithms specified in this Standard are designed
   both for hardware and software implementation.  They comply with
   modern cryptographic requirements, and put no restrictions on the
   confidentiality level of the protected information.

   The Standard applies to developing, operation, and modernization of
   the information systems of various purposes.

To me this suggests broad applicability.

I would expect to find a discussion on applicability in the Introduction
or in the Security Considerations.  For those who didn't read, the
security considerations is:

   6.  Security Considerations

   This entire document is about security considerations.

Which leaves a lot to desire.

> Do you envision some other kind of guidance?

Yes, see the last paragraph of:
https://www.ietf.org/mail-archive/web/cfrg/current/msg07876.html

/Simon