From: Melinda Shore <melinda.shore@gmail.com>
To: draft-ietf-jose-cfrg-curves.all@ietf.org
Message-ID: <ca99da3c-ff2e-798d-aa3a-27d435a4e096@gmail.com>
Date: Fri, 12 Aug 2016 14:41:56 -0800
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:45.0)
 Gecko/20100101 Thunderbird/45.2.0
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha512;
 protocol="application/pgp-signature";
 boundary="AF63xiqGpvrh5rkxWOhUPVDSOSBD9TiMv"
Archived-At: <https://mailarchive.ietf.org/arch/msg/secdir/vRIqq4C9A-3PJ4yghvJLbhPhuus>
Cc: secdir@ietf.org
Subject: [secdir] secdir review of draft-ietf-jose-cfrg-curves-05
Precedence: list

This is an OpenPGP/MIME signed message (RFC 4880 and 3156)
--AF63xiqGpvrh5rkxWOhUPVDSOSBD9TiMv
Content-Type: multipart/mixed; boundary="qEpB4OopsseNxQxnvVnhnt5p4TFEK9cWW"
From: Melinda Shore <melinda.shore@gmail.com>
To: draft-ietf-jose-cfrg-curves.all@ietf.org
Cc: secdir@ietf.org
Message-ID: <ca99da3c-ff2e-798d-aa3a-27d435a4e096@gmail.com>
Subject: secdir review of draft-ietf-jose-cfrg-curves-05

--qEpB4OopsseNxQxnvVnhnt5p4TFEK9cWW
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable

[Note:  I was assigned draft-ietf-jose-cfrg-curves-03 but have
reviewed the most recent revision]

This document defines how to use the Diffie-Hellman algorithms
"X25519" and "X448" as well as the signature algorithms "Ed25519" and
"Ed448" from the IRTF CFRG elliptic curves work in JOSE, and in doing
so introduces new a key type and subtypes, and specifies registry
additions.  Section 3 specifies the application of the algorithms
within the JOSE framework.

Summary: ready, with very minor nits on formal publication
requirements

I do not have the cryptographic chops to perform a cryptographic
review of this draft.  The algorithms being added to JOSE in this
document are specified in a CFRG deliverable
(https://datatracker.ietf.org/doc/draft-irtf-cfrg-eddsa/), which is
currently under development (that is to say, mature but not
completed).  I am satisfied that this document pays heed to the
security considerations in the CFRG document.

The document appears complete and ready with respect to the needs
of someone implementing this specification.

Nits:

normative reference to an informational RFC (7748)
normative reference to an informational draft (draft-irtf-cfrg-eddsa)
later version of draft-irtf-cfrg-eddsa has been published
missing reference: "RFC-THIS" in IANA Considerations section

Melinda


--qEpB4OopsseNxQxnvVnhnt5p4TFEK9cWW--

--AF63xiqGpvrh5rkxWOhUPVDSOSBD9TiMv
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: OpenPGP digital signature
Content-Disposition: attachment; filename="signature.asc"

-----BEGIN PGP SIGNATURE-----
Comment: GPGTools - https://gpgtools.org

iQIcBAEBCgAGBQJXrlC1AAoJELiGRpM6HoEutVwP/1+FA6Ex9XtN9hg7zyCsZta5
RjDBDXyQpg3SdMeYkzWZ4dKaj5e+UGt+wZUsaHeQlDoRIcjgukzu2j8P9odRl52y
Mwet+HvNio+VppSb4+tgd0NZStKvs2xXstfeWvhtUXujCQ48GH1IwF6eqWS3xY2y
RSZ0a7P+ueUnxt5005nh97ZWChXwdAc+T5BD8kcTAqjTXos0vqyVypnk4Vhha3Vs
9Fuj1k1FvLoZVzQwKQXlzMFebRcmFSr0Jj5EkksqFzYQuBDwv+ZEFBPiODYhnRey
VJo90n3oJL/GTaW9J0GDEcmROj7lYI870/PhxM+0t2yjsdNudheFTlARv+niwiCm
/cGC/NdwJQh5OHtiS0WZgCJwq5XQeJgsdqfTuddxe8eVzVkwnNngrDDYJmiSTLjQ
RrsriQRQj7IcYsfN5nDy9hbSx0Bj2QWeuouGVoRu12lAKPtKe+1i7TCr9+foXIWx
6DbszNncSxTMRcj318/T8OQ6ypqPg4R4+GoqMsIWraTgtdfpWI78z7GEY6pF8djx
0+KREfnqZFjAORzk6MpJxf5sg3brWsx8TswMlLeKPT9KKZNsCF9CruBMqE7HMXmZ
ZhkrLo9C3wmUAM2VFLw2Tl2QAPRRvJTxBnFnRnjMO14nvruEgXA3qO79Nv8/Tkww
B5zydhhXLkPvNu8UGpSw
=Sx/S
-----END PGP SIGNATURE-----

--AF63xiqGpvrh5rkxWOhUPVDSOSBD9TiMv--