[dispatch] Re: [saag] FW: New Version Notification for draft-rsalz-4086bis-00.txt

[Michael StJohns <[e-mail]>]

After doing a quick read through -

 1. I think it would be a good idea to readdress randomness.
 2. I don't think this document is a good starting point.  Among other
    things it drops right into suggesting specific implementations
    without actually doing the analysis - I'm suspicious of documents
    that first provide a conclusion and then backfill with supporting
    argument.  The other issue here is a lack of discussion about
    entropy sources. Among other things, reseeding from an entropy
    source is dependent on the sources entropy rate and the DRBGs
    characteristics rather than just the DRBG requirements.  E.g.
    compare and contrast this to 4086.  Starting from 4086 is probably a
    better choice than this document - and mostly should concentrate on
    changes in the literature since this was published in 2005.  In
    general, there are a LOT more hardware based Entropy sources
    available these days - both in free standing chips (e.g. TPMs, chip
    scale HSMs) and as part of the processing environment (e.g. Intel
    RDRAND and RDSEED instructions).
 3. The general topic of DBRGs is probably a better fit for CFRG than
    anything in the SAAG side. Basically, these are cryptographic
    constructs - we might do well asking the CFRG to suggest a few
    different DBRGs. But AIRC, referrals to RGs are not valid DISPATCH
    outcomes.
 4. Anything on the IETF side should probably concentrate on security
    measurement or performance requirements - e.g. DBRG passes the X
    suite of tests, TRNG passes Y suite of tests and provides n bits of
    entropy per second after a m initialization hold down time.

Mike
On 10/5/2026 13:27, Salz, Rich wrote:
> Damien Miller and I have written a first draft of RFC 4086bis and we 
> would like it dispatched. Note that 4086 was an individual draft, and 
> we’d be fine with AD-sponsored. Both of us will be on-site for IETF 127.
>
> This note is sent to both DISPATCH, to get on the agenda,  and SAAG 
> for detailed technical review.
>
> On 10/5/26, 1:04 PM, "[e-mail]" 
> <[e-mail]> wrote:
>
> A new version of Internet-Draft draft-rsalz-4086bis-00.txt has been
> successfully submitted by Rich Salz and posted to the
> IETF repository.
>
> Name:     draft-rsalz-4086bis
> Revision: 00
> Title:    On Random Numbers
> Date:     2026-10-05
> Group:    Individual Submission
> Pages:    7
> URL: https://www.ietf.org/archive/id/draft-rsalz-4086bis-00.txt
>
> …
>
> Abstract:
>
>    Things have changed a great deal in the two decades since RFC 4086,
>    "Randomness Requirements for Security," was published.  In addition,
>    as more IETF protocols use cryptography, the need for good-quality
>    randomness has greatly increased.
>
>
> _______________________________________________
> saag mailing list [e-mail]
> To unsubscribe send an email [e-mail]