Re: [Cfrg] RFC 5742 conflict review for draft-dolmatov-kuznyechik

[Yoav Nir <[e-mail]>]

> On 4 Feb 2016, at 9:00 PM, Watson Ladd <[e-mail]> wrote:
> 
> 
> On Feb 4, 2016 9:18 AM, "Dan Harkins" <[e-mail] <mailto:[e-mail]>> wrote:
> >
> >
> > On Wed, February 3, 2016 8:09 am, Blumenthal, Uri - 0553 - MITLL wrote:
> > > On 2/3/16, 5:23 , "Simon Josefsson" <[e-mail] <mailto:[e-mail]>> wrote:
> > >
> > >>   The cryptographic algorithms specified in this Standard are designed
> > >>   both for hardware and software implementation.  They comply with
> > >>   modern cryptographic requirements, and put no restrictions on the
> > >>   confidentiality level of the protected information.
> > >>
> > >>   The Standard applies to developing, operation, and modernization of
> > >>   the information systems of various purposes.
> > >>
> > >>To me this suggests broad applicability.
> > >
> > > Frankly, I don't see why "it" (those other-than-AES algorithms)
> > > shouldn't
> > > be "broadly applicable". AES is mandatory to implement to provide
> > > interoperability. There's nothing inherently holy about it. If two
> > > communicating entities (which both must have AES support to be compliant)
> > > happened to implement, e.g., Camellia, and want to communicate using it -
> > > it's not my business (and not your business) to tell them not to.
> >
> >   Amen! Agree. +1 and all that.
> 
> Is that what actually happens? Or do administrators and programmers have no clue about which primitives are secure, and assume that the protocols will provide security no matter how configured? We can also add in the disaster that is the usual API for using these standards, thanks to all the complexity that implementations feel a need to offer.
> 
> 

That depends on the administrators and on the programmers. For example, and administrator in Russia whose systems transmit data that the law requires to be encrypted (financial, medical, personnel records, anything to do with strategic industries like oil, gas, and munitions) is going to follow the law and configure GOST-approved algorithms such as kuznyechik regardless of how she feels about the merits of Kuzneychik vs AES or ChaCha20. A programmer who maintains the TLS or IPsec or SSH implementation for such an administrator will include these algorithms in the product.  

Similarly an administrator for a hospital or HMO in the United States is bound by HIPAA to use best practices to protect the data, and although HIPAA does not prescribe specific algorithms, or even encryption at all, such an administrator is likely to configure NIST-approved algorithms and perhaps choose a product that has FIPS certification to avoid liability.

Other administrators might use whatever is the default in the library or product that they use. That leads programmers to optimize the defaults for maximum interoperability, which is why it’s taking so long to get rid of things like RC4 and MD5.

Yoav