Re: [Cfrg] irsg review of draft-mcgrew-hash-sigs-12

[Stephen Farrell <[e-mail]>]

Hiya,

Just on one point... (all else seems good)

On 05/09/18 02:50, Scott Fluhrer (sfluhrer) wrote:
>> And to be clear: picking an MTI here just means that those who want
>> to use this won't have to, but can if they want, argue about what's
>> right for their particular situation.

> That is the problem with a single MTI; there are a number of
> different possible applications, each with different requirements.

I disagree. We have seen cases (e.g. [1]) where CFRG RFCs
leaving in options has lead to IETF WGs debating what to do,
over and over. That seems to me to be CFRG's "fault" as it's
predictable and could affect interop.

In this case, picking one MTI would mean that anyone who wants
to use LMS would just adopt that MTI option if it works for
their application. If it doesn't work for them, then they can
pick another option, but might not be able to use any random
implementation.

Separately, the key roll over issue is something that I don't
think need be addressed in this document, but would need to be
addressed in the IETF since there are LMS options that would
definitely need that. I didn't suggest an HSS option as the
MTI because that'd likely have bigger and more computationally
intensive signatures, so seems to me less likely to encourage
adoption.

I do agree with you though that picking an MTI option would
need the RG to debate the topic. I've no idea if people are
in the mood for that.

Cheers,
S.

[1] https://tools.ietf.org/html/rfc8032#section-4