Re: [Cfrg] draft-atkins-suit-cose-walnutdsa on the Independent Stream

[Derek Atkins <[e-mail]>]

Dear All,

I want to apologize for the delay in sending this response; I was traveling out of the country all of last week.

I want to reply to Kenny’s points by saying that section 5.2 of the draft deals specifically with all the analysis that occurred before, during, and since the NIST Round 1 process.  What Kenny is pointing out is old news, and it’s quite clear how to choose parameters today taking in to consideration everything that Kenny raises. Yes, the parameters chosen in 2017 were too small.  But the summary of https://eprint.iacr.org/2019/472 in section 5.2 shows that each attack is exponential in parameters N and q, and amusingly they are all exponential to approximately the same degree, O(q^((N-1)/2)).  So contrary to what Kenny has said, choosing parameters today is straightforward.  Please see that paper and section 5.2 for more details.

WalnutDSA was not accepted into Round 2 and after meeting with NIST, it was explained there were a host of reasons, many unrelated to the analysis in Round 1. NIST had to make cuts somewhere, and we know they will make more cuts going into Round 3 as many valid methods may not meet the additional criteria NIST may choose to apply.  Based on recent analysis of NewHope going into Round 3, would that change how you feel about it?

This draft is an informational draft, not a standard.  More specifically, it’s a document about how one would use WalnutDSA within COSE, and not about WalnutDSA specifically.  Moreso, it specifically says that WalnutDSA is “not recommended” in the IANA considerations section.  The goal of this draft is to ensure that implementers can write interoperable code that can at least parse the COSE objects in a consistent way.  It says nothing about whether you should trust it as a result of this process, let alone use it.

While I am not asking CFRG to bless WalnutDSA, I am asking it to allow the ISE to publish our request under the guidelines and mandate it has for addressing informational drafts – nothing more and nothing less.

-derek

PS: Apologies to those who get this twice; the CFRG list bounced back my original message sent from my work address.

-- 
       Derek Atkins                 617-623-3745
       [e-mail]             www.ihtfp.com
       Computer and Internet Security Consultant