Re: [CFRG] [Crypto-panel] Request for review of draft-fluhrer-lms-more-parm-sets

["Scott Fluhrer (sfluhrer)" <[e-mail]>]

As for the relation between this ID and NIST SP 800-208, I believe that they use the exact same hash function; SHA-256/192 uses SHA-256 truncated to 192 bits (800-208 calls this “the most significant (i.e., leftmost) 192 bits of the SHA-256 hash of M.”), while the SHAKE256/256 and SHAKE256/192 are the SHAKE256 algorithm using the initial 32 or 24 bytes of SHAKE output.

From: Crypto-panel <[e-mail]> On Behalf Of Ludovic Perret
Sent: Thursday, June 30, 2022 3:27 PM
To: [e-mail]; [e-mail]; [e-mail]
Cc: Stanislav V. Smyshlyaev <[e-mail]>
Subject: [Crypto-panel] Request for review of draft-fluhrer-lms-more-parm-sets

Dear,

The review is below.

My main point is about the unclear relation between this ID and NIST SP 800-28; which is also providing different hash functions for LMS.


Review.

RFC 8554 describes and specifies LMS, a stateful hash-based signature scheme. This ID proposes new parameter sets for LMS.
In particular, RFC 8554 only used SHA256. Here, the main idea is to consider also SHAKE256-based hash functions (with outputs of 192 and 256 bits)
and a variant of SHA256 truncated to 192 bits.  These changes lead to the smaller signature sizes for 192 bits hash functions. This should not be the case
for SHAKE256_256. But I believe that it makes sense to consider this variant to have more reasonable options for the hash function.  Still, the authors
should maybe add a sentence on that (I.e. the motivation is different between SHAKE256_256  and SHAKE256_192 SHA256_192 or SHA256_192 ).

For the new 192 bits parameters, the security also decreased with respect to the initial LMS parameters (using NIST security levels, we move from level 5 to Level 3).
That remains a very comfortable security margin. But, I feel that this point should be a bit more emphasized in the document.

The note is going straight to the point. That’s fine in general, as it is very much a compliment to RFC 8554. It is not necessary
to duplicate backgrounds. For me, there is one exception in 3.1; it should be good to recall what are the « C randomizer » and the « I identifier ».

What I missing more is a small paragraph explaining the rationale for choosing the parameters (not long, but just to get a flavor).
Also, timings could be a good addition (in particular for SHAKE256_X; timings for SHA256_192 is pointless).

Finally, the document is not quoting the NIST Special Publication 800-208 « Recommendation for Stateful Hash-Based Signature Schemes »
that do proposed variants of LMS based on the same hash functions. It is not completely clear to me what is the difference/relation between this
ID and the SP at this stage? The ID was indeed submitted before SP 800-208n, but the SP is now public.

Typos :


Abstract : « Hese include hash functions that result in signatures with significantly smaller than the signatures using the current parameter sets » —>
 « These include hash functions that result in signatures significantly smaller than the signatures using the current parameter sets »

Best Regards,

Ludovic,

and?




Le 19 juin 2022 à 22:06, Ludovic Perret <[e-mail]<mailto:[e-mail]>> a écrit :

I am on it; before the end of this month.
Best Regards,
Ludovic,

Le 16/06/2022 à 18:54, Stanislav V. Smyshlyaev a écrit :
Hi Ludovic,

Could you please let us know about your plans for finishing the review on behalf of the Crypto Review Panel?

Regards,
Stanislav, Alexey, Nick

On Wed, Jun 1, 2022 at 2:41 PM Perret <[e-mail]<mailto:[e-mail]>> wrote:
Yes, it’s coming soon.

Cheers

Ludovic
Envoyé de mon iPhone


Le 1 juin 2022 à 07:03, Stanislav V. Smyshlyaev <[e-mail]<mailto:[e-mail]>> a écrit :

Hi Ludovic,

Any news about the review?..

Regards,
Stanislav


On Mon, May 16, 2022 at 1:36 PM Stanislav V. Smyshlyaev <[e-mail]<mailto:[e-mail]>> wrote:
Ok, thanks a lot, we look forward to your review!

Regards,
Stanislav

On Mon, May 16, 2022 at 1:30 PM Ludovic Perret <[e-mail]<mailto:[e-mail]>> wrote:
Hi,
By the end of this month.
Best Regards,
Ludovic,

Le 16/05/2022 à 08:02, Stanislav V. Smyshlyaev a écrit :
Ludovic?..

Regards,
Stanislav

On Thu, May 12, 2022 at 9:24 AM Stanislav V. Smyshlyaev <[e-mail]<mailto:[e-mail]>> wrote:
Dear Ludovic,

Could you please kindly let us know, when you are planning to finish your review?

Regards,
Stanislav

On Mon, Apr 25, 2022 at 9:02 PM Stanislav V. Smyshlyaev <[e-mail]<mailto:[e-mail]>> wrote:
Thank you, Ludovic! Yes, that is needed and highly desired. :)

Regards,
Stanislav

On Mon, 25 Apr 2022 at 20:02, Ludovic Perret <[e-mail]<mailto:[e-mail]>> wrote:
Dear,
If needed, happy to volunteer.
Best Regards,
Ludovic,

Le 25/04/2022 à 18:59, Russ Housley a écrit :
I reviewed a long time ago, and once IANA assigned the code points, I implemented.

Please publish as soon as practical.

Russ



On Apr 25, 2022, at 11:13 AM, Scott Fluhrer (sfluhrer) <sfluhrer=[e-mail]<mailto:sfluhrer=[e-mail]>> wrote:

I would like to request a review of draft-fluhrer-lms-more-parm-sets, which are parameter sets for LMS based on various hash functions (SHA-256 truncated to 192 bits, as well as SHAKE-256 at 192 and 256 bit lengths)




_______________________________________________

Crypto-panel mailing list

[e-mail]<mailto:[e-mail]>

https://www.irtf.org/mailman/listinfo/crypto-panel

--

Ludovic Perret

Maître de conférences

PolSys/LIP6/Sorbonne Université

--

Ludovic Perret

Maître de conférences

PolSys/LIP6/Sorbonne Université

--

Ludovic Perret

Maître de conférences

PolSys/LIP6/Sorbonne Université