[secdir] SECDIR Last Call review of draft-ietf-lamps-rfc8708bis-01

[Donald Eastlake <[e-mail]>]

I have reviewed this document as part of the security directorate's
ongoing effort to review all IETF documents being processed by the
IESG. Document editors and WG chairs should treat these comments just
like any other last call comments.

The summary of the review is Ready with Nits.

This document specifies the conventions for using the Hierarchical
Signature System (HSS) / Leighton-Micali Signature (LMS) hash-based
signature algorithm with the Cryptographic Message Syntax (CMS) and
provides the algorithm identifier and public key syntax.

All my comments below are minor to very minor.

Section 6, Security Considerations, 1st paragraph. Why is it that
compromise of the private keys only "may" lead to the ability to
forge? "May" seems right for something like "result in forged
signatures" but doesn't compromise of the private key lead pretty
certainly to the *ability* to forge a signature?
Somehow the presence of "non-volatile" is a bit jarring. I understand
that you are talking about exceptional problems but perhaps it would
be good to also say the "volatile" storage must not be used?

Section 1.3, 3rd paragraph: Would it be reasonable to add just before
the comma in the first sentence "but on the difficulty of finding
pre-images of a strong hash function" or something like that? While I
believe it, is there a reference for the "considered to be
post-quantum secure" statement?

Section 2.1, last sentence: While it is somewhat a matter of taste,
arguably, except in the most surprising cases, the words "Note that"
are mostly superfluous noise. (Ditto for two more "Note that"s in
Section 4.)

Thanks,
Donald
===============================
 Donald E. Eastlake 3rd   [phone] (cell)
 2386 Panoramic Circle, Apopka, FL 32703 USA
 [e-mail]