Re: [Cfrg] Please review/comment on draft-moskowitz-hip-new-crypto-02

Bith Ketje and Keyak were in the CEASER final round, but not chosen for the final portfolio. It is a bit disappointing that there is no report from the competition. I understand that wring reports take time, but the lack of any reasoning behind the chosen ciphers reduces the value of the competition a bit.

XOODYAK in the NIST lightweight competition used the XOODOO permutation which they say is inspired by KECCAC-p.

John

From: Robert Moskowitz <rgm-sec@htt-consult.com>
Date: Thursday, 3 October 2019 at 18:31
To: John Mattsson <john.mattsson@ericsson.com>, IRTF CFRG <cfrg@irtf.org>
Subject: Re: [Cfrg] Please review/comment on draft-moskowitz-hip-new-crypto-02

I think it was Ketje as the Keccak CEASAR proposal.  As I understand it, Koodyak is the Keccak proposal in Round 2 of the NIST competition.  Perhaps I need to study Koodyak a bit more.

https://csrc.nist.gov/projects/lightweight-cryptography/round-2-candidates

On 10/3/19 12:17 PM, John Mattsson wrote:
Interesting! Specifing some AEAD based on Keccac seems to make sense.

I noted that Keyak was not chosen in the CEASAR final portfolio, do anyone know why? I cannot find any report from the
CEASAR competition…..

Are any Keccac based ciphers submitted to the NIST's lightweight crypto competition? If I remember correctly NIST was previously talking about standardizing a Keccac based AEAD, but I have not seen any info on that for a while.

Cheers,
John

From: Cfrg <cfrg-bounces@irtf.org><mailto:cfrg-bounces@irtf.org> on behalf of Robert Moskowitz <rgm-sec@htt-consult.com><mailto:rgm-sec@htt-consult.com>
Date: Thursday, 3 October 2019 at 17:47
To: "cfrg@irtf.org"<mailto:cfrg@irtf.org> <cfrg@irtf.org><mailto:cfrg@irtf.org>
Subject: [Cfrg] Please review/comment on draft-moskowitz-hip-new-crypto-02

This draft adds support of EdDSA, EC25519/EC448, and Keccak hashes and cipher (Keyak) to HIP (rfc 7401).

The interest to this group, is I believe this is the 1st? major adoption of Keccak (FIPS 202, sp800-185, and sp800-56Cr1) in IETF drafts.

KMAC vs HMAC is perhaps the simplest change.  It would seem that KMAC (sp800-185) is more efficient than HMAC and might be of advantage to high capacity situations.

Then there is the KDF based on sp800-56Cr1 (called KEYMAT in HIP lingo).  This is a significant change from RFC5869 and sp800-108.  But I have assurances? that it meets the needed strength requirements.

Finally I am perhaps 'jumping the gun' on NIST's lightweight crypto competition with specifying Keyak, but for a constrained device developer, it means one underlying engine to support.

TBD is a separate draft to amend RFC7402 to add Keyak to HIP's use of ESP (and include diet-ESP).

The only 'hidden' gotcha is EdDSA25519 using SHA512 rather than a cSHAKE256 with 512 bits output (see KEYMAT above).  This has code-size implications to constrained system developers.  Otherwise it is all 'new' crypto.

======================================

A new version of I-D, draft-moskowitz-hip-new-crypto-02.txt

has been successfully submitted by Robert Moskowitz and posted to the

IETF repository.

Name:            draft-moskowitz-hip-new-crypto

Revision: 02

Title:           New Cryptographic Algorithms for HIP

Document date:   2019-10-03

Group:           Individual Submission

Pages:           12

URL:            https://www.ietf.org/internet-drafts/draft-moskowitz-hip-new-crypto-02.txt<https://protect2.fireeye.com/url?k=f5f3e143-a97a3b6f-f5f3a1d8-0cc47ad93da2-a719c860baead1e6&q=1&u=https%3A%2F%2Fwww.ietf.org%2Finternet-drafts%2Fdraft-moskowitz-hip-new-crypto-02.txt>

Status:         https://datatracker.ietf.org/doc/draft-moskowitz-hip-new-crypto/<https://protect2.fireeye.com/url?k=fffb3b7c-a372e150-fffb7be7-0cc47ad93da2-78d83682ccfc8b3a&q=1&u=https%3A%2F%2Fdatatracker.ietf.org%2Fdoc%2Fdraft-moskowitz-hip-new-crypto%2F>

Htmlized:       https://tools.ietf.org/html/draft-moskowitz-hip-new-crypto-02<https://protect2.fireeye.com/url?k=f062eb91-aceb31bd-f062ab0a-0cc47ad93da2-22cb8134989de627&q=1&u=https%3A%2F%2Ftools.ietf.org%2Fhtml%2Fdraft-moskowitz-hip-new-crypto-02>

Htmlized:       https://datatracker.ietf.org/doc/html/draft-moskowitz-hip-new-crypto<https://protect2.fireeye.com/url?k=5d6da924-01e47308-5d6de9bf-0cc47ad93da2-5e91e8000092fe70&q=1&u=https%3A%2F%2Fdatatracker.ietf.org%2Fdoc%2Fhtml%2Fdraft-moskowitz-hip-new-crypto>

Diff:           https://www.ietf.org/rfcdiff?url2=draft-moskowitz-hip-new-crypto-02<https://protect2.fireeye.com/url?k=d7be9813-8b37423f-d7bed888-0cc47ad93da2-ef6e3ea349ba4e7c&q=1&u=https%3A%2F%2Fwww.ietf.org%2Frfcdiff%3Furl2%3Ddraft-moskowitz-hip-new-crypto-02>

Abstract:

   This document provides new cryptographic algorithms to be used with

   HIP.  The Edwards Elliptic Curve and the Keccak sponge functions are

   the main focus.  The HIP parameters and processing instructions

   impacted by these algorithms are defined.

Please note that it may take a couple of minutes from the time of submission

until the htmlized version and diff are available at tools.ietf.org.

The IETF Secretariat

_______________________________________________

Cfrg mailing list

Cfrg@irtf.org<mailto:Cfrg@irtf.org>

https://www.irtf.org/mailman/listinfo/cfrg<https://protect2.fireeye.com/url?k=774ff9ca-2b9bf53b-774fb951-864685b2085c-c93dad1cd27ae9b5&q=1&u=https%3A%2F%2Fwww.irtf.org%2Fmailman%2Flistinfo%2Fcfrg>