Re: [Cfrg] On the (non-)randomness of the S-box of Streebog and Kuznyechik

[Dmitry Belyavsky <[e-mail]>]

Dear Stephen,

RFC 7091 seems to be a translation of the corresponding GOST standard.

RFC 8624 contains a reference to RFC5933, where the GOST algorithms for
DNSSec were introduced.
The reference is correct, the reference to the superseding algorithms is
correct too.

So it seems that no errata required here.


On Tue, Aug 6, 2019 at 4:56 PM Stanislav V. Smyshlyaev <[e-mail]>
wrote:

> Dear Stephen,
>
> >> So that sounds like an erratum may be worthwhile for each of 8624 and
> 7901? I guess the code points defined for DNSSEC are really for the old
> algorithms and ought not point to the RFCs for the new ones?
> >> And that hasn't really got anything to do with the meat of Leo's
> findings - it's just that his work flagged up the erroneous references.
> Personally, I agree that it would be good to do the updates here. But, as
> for DNSSEC, I hope that the authors of RFC 5933 (or, maybe, Dmitry
> Belyavsky) can comment better.
>
>
>
> вт, 6 авг. 2019 г. в 16:33, Stephen Farrell <[e-mail]>:
>
>>
>> Hiya,
>>
>> On 06/08/2019 14:14, Stanislav V. Smyshlyaev wrote:
>> > Stephen, GOST R 34.11-94 is built using a completely different
>> > construction, so (Leo will correct me, if I am mistaken) the discovered
>> > properties are not related to GOST R 34.11-94. I’d also like to clarify
>> > that this GOST R 34.11-94 is an old hash function, which has been
>> > deprecated for about 7 years in Russia.
>>
>> So that sounds like an erratum may be worthwhile
>> for each of 8624 and 7901? I guess the code points
>> defined for DNSSEC are really for the old algorithms
>> and ought not point to the RFCs for the new ones?
>> Those'd be valid errata I reckon, as it was a bit
>> of a mistake (though entirely understandable) to
>> refer to the new RFCs when the code points are for
>> the old algorithms. Those errata would just say
>> that the normative references to the new RFC were
>> wrong and should've been to the old RFC. And that
>> hasn't really got anything to do with the meat of
>> Leo's findings - it's just that his work flagged
>> up the erroneous references.
>>
>> As to whether to deprecate the algorithms due to
>> Leo's findings, I agree that the existence of
>> deployments that'd be affected needs to be taken
>> into account in terms of the timing of when that
>> might reasonably be done. And the fact that the
>> algorithms in question are national standards is
>> also a relevant point, though of course deprecating
>> the RFCs has no formal effect on such national
>> standards.
>>
>> Personally though, I think discovery of undeclared
>> and unexplained structure such as this in a crypto
>> algorithm ought be taken as a negative, even if there
>> is no known attack at present, so I'd be for moving
>> to deprecate when that is practical, in this case,
>> as I would in any other similar case.
>>
>> Cheers,
>> S.
>>
>

-- 
SY, Dmitry Belyavsky