Re: [Cfrg] CFRG Crypto Panel review: draft-krovetz-rc6-rc5-vectors-00

["RFC ISE (Adrian Farrel)" <[e-mail]>]

Thanks for this one, too, Yaron.

Not as much flame as for draft-krovetz-ocb-wideblock, but equally clear.

Again, I will be talking with Ted.

Thanks,
Adrian


Yaron Sheffer wrote:
>               body p { margin-bottom: 0cm; margin-top: 0pt; }
> Summary: this review was taken at the request of the ISE. He
> asked     that we pick one of:
>
>      1) this is a good idea and should be taken by CFRG
>      2) this is a good idea and should be published in the Independent
> Stream
>      3) this is a good idea, but needs some fixes
>      4) this is not a good idea and should not be published.
>
>      I would pick #4, this is not a good idea. Formally, the document
> lists test vectors for algorithms that are not properly
> standardized. Pragmatically, I see no industry demand or need for
> these two algorithms to be standardized today.
>
>      Details:
>
>      - RC5 is not used by any Internet protocols, to the best of my
> knowledge, although it is specified for a few, e.g. ESP. It is
> defined by the old RFC 2040 (published back in 1996, when we still
>  used to have 40-bit "export" keys, and cited by very few documents
>   since).
>      - RFC 2040 actually does have test vectors.
>      - For some reason RFC 2040 is cited as an informative, not a
> normative reference for RC5.
>      - The I-D does not cite any standard as the authoritative reference
>   for RC6 (a patent does not count, and Google does not find the
> cited     normative reference). This seems to me a prerequisite
> before we can     publish test vectors. The document refers to the
> algorithms'     "specifications" and I fail to understand what this
> means, in the     case of RC6. Wikipedia has a link to a paper on Ron
> Rivest's web     page as their best authority. Academic papers on
> cryptographic     protocols are not anywhere near a formal standard,
> as far as     supporting implementors.
>      - The document makes security recommendations on how the algorithms
>   should be used, by including recommended parameter sets. This is
>  very good, but belongs in a normative specification of the algorithm
>     rather than a document that lists test vectors.
>      - The first RC6 test vector uses a 32-bit key, and the second a
> 64-bit key. Both of which are not acceptable nowadays. Similarly for
>    RC5.
>      - Another test vector is missing the key, which I assume is a typo.


-- 
Adrian Farrel (ISE),
[e-mail]