Re: [lamps] WGLC comments draft-ietf-lamps-cms-shakes-01

[Russ Housley <[e-mail]>]

Quynh, Panos, and Jim:

While it does look like a simple substitution, I do not think the LAMPS is the right group to make the assessment.  CFRG may have people with the right skills.

Russ



> On Sep 17, 2018, at 2:08 PM, Panos Kampanakis (pkampana) <pkampana=[e-mail]> wrote:
> 
> I think that falls outside the scope of this spec and the LAMPS charter to be honest.
> I mean, introducing a new MFG should not be taken lightly even if it is straightforward.
> Panos
>  
> From: Jim Schaad [mailto:[e-mail] <mailto:[e-mail]>] 
> Sent: Monday, September 17, 2018 11:39 AM
> To: 'Russ Housley' <[e-mail] <mailto:[e-mail]>>; 'Quynh Dang' <[e-mail] <mailto:[e-mail]>>; Panos Kampanakis (pkampana) <[e-mail] <mailto:[e-mail]>>
> Cc: 'SPASM' <[e-mail] <mailto:[e-mail]>>
> Subject: RE: [lamps] WGLC comments draft-ietf-lamps-cms-shakes-01
>  
> Russ,
>  
> That is not the question that I was asking.  I think that replacing SHA-1 with SHAKE in the MFG function is correct.  I was proposing replacing the MFG function in its entirety with a new MFG function.
>  
> Jim
>  
>  
> From: Spasm <[e-mail] <mailto:[e-mail]>> On Behalf Of Russ Housley
> Sent: Monday, September 17, 2018 2:53 AM
> To: Quynh Dang <[e-mail] <mailto:[e-mail]>>; Panos Kampanakis <[e-mail] <mailto:[e-mail]>>
> Cc: SPASM <[e-mail] <mailto:[e-mail]>>
> Subject: Re: [lamps] WGLC comments draft-ietf-lamps-cms-shakes-01
>  
> Here is a part of a message to resolve the WG Last Call comments on draft-ietf-lamps-cms-shakes-01 ...
>  
> 
> * Message Digests - are the limits on the size only for CMS or do they apply
> everywhere that the algorithm is used.  If it is everywhere how do we
> reconcile with the usage in RSA-PSS? 
>  
> Comment 5: Only in CMS, when a message digest is generated. For RSA-PSS,  a SHAKE has 2 different output sizes for 2 different uses: hashing a message to be signed and generating a masking value in MGF 1. 
> [JLS] After looking at this a second time, I propose that this problem be solved by creation of a new mask generation function MGF-V.   We can eliminate the counter from the operation as being un-needed and just compute the mask length and generate that many bits of input from a SHAKE function.
>  
> I thought about that. But that would be another standard function which have not been defined  yet. How could we go from here ? And this route would take time. Using the existing MGF 1 would waste only 1 division: to figure out counter number is zero: so there is only one hash function execution. 
> [JLS2] No it is more than that.  It takes both the one division AND a concatenation AND the strangeness for trying to decide how long the SHAKE output is if one is placing it into an existing MGF1 piece of code.  If you define a new MGF-V then there is a new function that is called – which code should potentially be setup for – and zero extra work beyond that.  The size of the mask is the size of the output, no concatenation.  It is much cleaner in my opinion.
>  
> Does anyone think that using SHAKE in the RSA-PSS mask generation function is the wrong approach?
>  
> Russ
>