[Crypto-panel] Re: Request for review: Usage Limits on AEAD Algorithms

[Martin Thomson <[e-mail]>]

Hey,

Felix went through and addressed these comments.  They were, as I suspected, quite straightforward.

Thanks again Thomas.

Stanislav, we can get you a fresh revision if you think this is ready to push.  Let me know.  (I'll assume you want a revision unless I hear otherwise.)

Cheers,
Martin

On Thu, Aug 1, 2024, at 11:55, Martin Thomson wrote:
> Thanks for this.  Just from skimming through it seems like this is all 
> very useful feedback that should be fairly straightforward to address 
> on the whole.
>
> I've dumped this all on an issue, so we don't lose it, but we'll 
> probably come at it piecewise.
>
> https://github.com/cfrg/draft-irtf-cfrg-aead-limits/issues/67
>
> We'll post to the list (and cc you) if there are questions that come up.
>
> On Thu, Aug 1, 2024, at 00:26, Thomas Pornin wrote:
>> Oops, looks like I had forgotten it. Sorry.
>> 
>> Here is my review. Overall, the document is a nice endeavour; since the 
>> focus is on IETF protocols, it might be worth to give a few more 
>> applied examples? The tables in the document give number of 1500-byte 
>> messages (“a common Internet MTU”) which would conceptually apply to 
>> something like IPsec, though less so for e.g. SSH or TLS, which have 
>> larger “records”. I also have some misgivings on the advice in section 
>> 7 which amounts to, basically, ignoring in implementations the limits 
>> that the rest of the document takes pains to define; as a “security 
>> consideration”, it does not seem conductive of security.
>> 
>> Thomas
>> 
>> *From: *Stanislav V. Smyshlyaev <[e-mail]>
>> *Date: *Wednesday, June 12, 2024 at 12:07
>> *To: *Thomas Pornin <[e-mail]>
>> *Cc: *[e-mail] <[e-mail]>, 
>> [e-mail] <[e-mail]>, 
>> [e-mail] 
>> <[e-mail]>
>> *Subject: *Re: [Crypto-panel] Request for review: Usage Limits on AEAD 
>> Algorithms
>> Thank you so much, Thomas!
>> 
>> Regards,
>> Stanislav
>> 
>> On Wed, 12 Jun 2024 at 19:04, Thomas Pornin <[e-mail]> wrote:
>>> I can make a review (by mid-July, possibly much sooner).
>>>  
>>> Thomas
>>>  
>>> *From: *Stanislav V. Smyshlyaev <[e-mail]>
>>> *Date: *Tuesday, June 11, 2024 at 03:30
>>> *To: *[e-mail] <[e-mail]>
>>> *Cc: *[e-mail] <[e-mail]>, [e-mail] <[e-mail]>
>>> *Subject: *[Crypto-panel] Request for review: Usage Limits on AEAD Algorithms
>>> Dear Crypto Panel experts,
>>> 
>>> The chairs would like to ask the Crypto Panel to provide a review for the current version (-08) of the "Usage Limits on AEAD Algorithms" draft, draft-irtf-cfrg-aead-limits-08  (https://www.ietf.org/archive/id/draft-irtf-cfrg-aead-limits-08.html)
>>> 
>>> Volunteers?
>>> 
>>> Stanislav (on behalf of the CFRG Chairs)
>> Attachments:
>> * review-draft-irtf-cfrg-aead-limits-08.txt