Re: [lamps] [EXTERNAL] Re: [EXT] Re: WGLC for draft-ietf-lamps-cms-sha3-hash

[Mike Ounsworth <[e-mail]>]

Russ,

 

I don’t think we’re talking about KMAC as a MAC – we’re talking about KMAC as a KDF, right?

 

draft-ietf-lamps-cms-sha3-hash Section 5: Key Derivation Functions lists

 

* HKDF with SHA3

* KDF2 and KDF3 with SHA3

 

HKDF is HMAC underneath, which will be 2 invocations of SHA3. I don’t know what the KDF2 or KDF3 constructions are because I am not paying for the document.

 

KMAC is only a single invocation of SHA3, so I think this document would benefit from defining id-alg-kdf-kmac-128 and id-alg-kdf-kmac-256, with suitable instantiations of KMAC, in addition to the HKDF and KDF2 / KDF3 ones that are already in there.

 

Copying from my parallel email on this thread, there will be existing implementations of HKDF-SHA2 where the existing crypto agility easily allows for substitution of SHA2 for SHA3, but may not easily allow for substitution of the entire construction for KMAC, so I think there is value in leaving HKDF-SHA3 in.

 

---

Mike Ounsworth

 

From: Spasm <[e-mail]> On Behalf Of Russ Housley
Sent: Wednesday, February 7, 2024 10:09 AM
To: Uri Blumenthal <[e-mail]>
Cc: Daniel Van Geest <[e-mail]>; SPASM <[e-mail]>
Subject: [EXTERNAL] Re: [lamps] [EXT] Re: WGLC for draft-ietf-lamps-cms-sha3-hash

 

Uri: KMAC with SHAKE128 and KMAC with SHAKE256 are already specified for use as Message Authentication Codes in RFC 8702. Russ On Feb 7, 2024, at 10: 50 AM, Blumenthal, Uri - 0553 - MITLL <uri@ ll. mit. edu> wrote: > So then, are there 



Uri:

 

KMAC with SHAKE128 and KMAC with SHAKE256 are already specified for use as Message Authentication Codes in RFC 8702.

 

Russ

 

On Feb 7, 2024, at 10:50 AM, Blumenthal, Uri - 0553 - MITLL <[e-mail] <mailto:[e-mail]> > wrote:

 

>   So then, are there any suggestions on what to do with this?  Keep hkdf-with-sha3* and make  <mailto:[e-mail]> @Markku-Juhani O. Saarinen unhappy? 

 

I’m against it. I.e., count me as “unhappy” in this case too.

 

>  Slide KMAC into draft-ietf-lamps-cms-sha3-hash? Spin up a new draft for KMAC? 

 

Spinning up a new draft for KMAC sounds reasonable. I wouldn’t worry that it uses cSHAKE rather than SHA3.

 

>  Define an OID for KMAC in draft-ietf-lamps-cms-kyber (yuck)?

 

My gut feeling is “No”.

 

>  Force draft-ietf-lamps-cms-kyber to use KDF3 like rfc5990bis (and further commit to a paywalled spec)?

 

Absolutely not.

 

 

 

From: Spasm <[e-mail] <mailto:[e-mail]> > On Behalf Of Russ Housley
Sent: Tuesday, February 6, 2024 8:51 PM
To: Mike Ounsworth <Mike.Ounsworth=[e-mail] <mailto:Mike.Ounsworth=[e-mail]> >; Markku-Juhani O. Saarinen <[e-mail] <mailto:[e-mail]> >
Cc: Tim Hollebeek <tim.hollebeek=[e-mail] <mailto:tim.hollebeek=[e-mail]> >; SPASM <[e-mail] <mailto:[e-mail]> >
Subject: Re: [lamps] WGLC for draft-ietf-lamps-cms-sha3-hash

 

Mike and Markku:

 

Section 5 was added in October 2023because someone asked for KDFs.  I do not recall the source of the request.

 

Russ







On Feb 6, 2024, at 3:21 PM, Mike Ounsworth <Mike.Ounsworth=[e-mail] <mailto:Mike.Ounsworth=[e-mail]> > wrote:

 

Sorry, too quick on the SEND.

 

Markku is questioning why we need section 5.1 HKDF with SHA3.

 

---

Mike Ounsworth

 

From: Spasm < <mailto:[e-mail]> [e-mail]> On Behalf Of Mike Ounsworth
Sent: Tuesday, February 6, 2024 2:20 PM
To: Tim Hollebeek < <mailto:tim.hollebeek=[e-mail]> tim.hollebeek=[e-mail]>; SPASM < <mailto:[e-mail]> [e-mail]>; Markku-Juhani O. Saarinen < <mailto:[e-mail]> [e-mail]>
Subject: [EXTERNAL] Re: [lamps] WGLC for draft-ietf-lamps-cms-sha3-hash

 

I’m just gonna lob this in on  <mailto:[e-mail]> @Markku-Juhani O. Saarinen’s behalf.

 

He commented this morning that it’s un-necessary to do HMAC with SHA3. If you need a MAC, then KMAC is a single invocation of SHA3 vs two invocations in HMAC. And if you only need a KDF then (I think?) naked SHA3 is fine?

 

I’ll leave it to Markku to give the details here, but I wanted to make sure this got logged before WGLC closes.

 

---

Mike Ounsworth

 

From: Spasm < <mailto:[e-mail]> [e-mail]> On Behalf Of Tim Hollebeek
Sent: Tuesday, January 30, 2024 2:43 PM
To: SPASM < <mailto:[e-mail]> [e-mail]>
Subject: [EXTERNAL] [lamps] WGLC for draft-ietf-lamps-cms-sha3-hash

 

Hello,

 

Russ has suggested that draft-ietf-lamps-cms-sha3-hash might be ready for WGLC, and since it’s a pretty simple draft that seems like a pretty reasonable way to flush out any remaining comments and problems.

 

Therefore this is the WGLC for draft-ietf-lamps-cms-sha3-hash:

 

Use of the SHA3 One-way Hash Functions in the Cryptographic Message Syntax (CMS)

 <https://urldefense.com/v3/__https:/datatracker.ietf.org/doc/draft-ietf-lamps-cms-sha3-hash/__;!!FJ-Y8qCqXTj2!byPxBYPVZ9FW0iY4xIILY8VaxAuB50r17Pl74_V6yeLZ_6u55BDl5iFwdWmHwTM2b_3cIFpu-ktMwth2YQnANtgAaDTb$> https://datatracker.ietf.org/doc/draft-ietf-lamps-cms-sha3-hash/

 

Abstract

 

   This document describes the conventions for using the four one-way

   hash functions in the SHA3 family with the Cryptographic Message

   Syntax (CMS).

 

Please send comments to the list by 12 February 2024.

 

-Tim

 

_______________________________________________
Spasm mailing list
 <mailto:[e-mail]> [e-mail]
 <https://urldefense.com/v3/__https:/www.ietf.org/mailman/listinfo/spasm__;!!FJ-Y8qCqXTj2!byPxBYPVZ9FW0iY4xIILY8VaxAuB50r17Pl74_V6yeLZ_6u55BDl5iFwdWmHwTM2b_3cIFpu-ktMwth2YQnANlKRxjq-$> https://www.ietf.org/mailman/listinfo/spasm

 

_______________________________________________
Spasm mailing list
 <mailto:[e-mail]> [e-mail]
 <https://urldefense.com/v3/__https:/www.ietf.org/mailman/listinfo/spasm__;!!FJ-Y8qCqXTj2!byPxBYPVZ9FW0iY4xIILY8VaxAuB50r17Pl74_V6yeLZ_6u55BDl5iFwdWmHwTM2b_3cIFpu-ktMwth2YQnANlKRxjq-$> https://www.ietf.org/mailman/listinfo/spasm