Re: [Cfrg] On the (non-)randomness of the S-box of Streebog and Kuznyechik

[Stephen Farrell <[e-mail]>]

Hiya,

On 06/08/2019 14:14, Stanislav V. Smyshlyaev wrote:
> Stephen, GOST R 34.11-94 is built using a completely different
> construction, so (Leo will correct me, if I am mistaken) the discovered
> properties are not related to GOST R 34.11-94. I’d also like to clarify
> that this GOST R 34.11-94 is an old hash function, which has been
> deprecated for about 7 years in Russia.

So that sounds like an erratum may be worthwhile
for each of 8624 and 7901? I guess the code points
defined for DNSSEC are really for the old algorithms
and ought not point to the RFCs for the new ones?
Those'd be valid errata I reckon, as it was a bit
of a mistake (though entirely understandable) to
refer to the new RFCs when the code points are for
the old algorithms. Those errata would just say
that the normative references to the new RFC were
wrong and should've been to the old RFC. And that
hasn't really got anything to do with the meat of
Leo's findings - it's just that his work flagged
up the erroneous references.

As to whether to deprecate the algorithms due to
Leo's findings, I agree that the existence of
deployments that'd be affected needs to be taken
into account in terms of the timing of when that
might reasonably be done. And the fact that the
algorithms in question are national standards is
also a relevant point, though of course deprecating
the RFCs has no formal effect on such national
standards.

Personally though, I think discovery of undeclared
and unexplained structure such as this in a crypto
algorithm ought be taken as a negative, even if there
is no known attack at present, so I'd be for moving
to deprecate when that is practical, in this case,
as I would in any other similar case.

Cheers,
S.