Re: [lamps] draft-ietf-lamps-cms-shakes-07

[Jeffrey Walton <[e-mail]>]

On Thu, Feb 28, 2019 at 5:10 PM Russ Housley <[e-mail]> wrote:
>
> I was just looking at this document, and an inconsistency jumped out at me.
>
> Section 4.1 says that id-shake128-len and id-shake256-len have no parameters.
>
> However, as used in RFC 8419 has a parameter:
>
>       hashAlg-SHAKE256-LEN  ALGORITHM  ::=  { OID id-shake256-len
>                               PARMS ShakeOutputLen }
>
>       id-shake256-len  OBJECT IDENTIFIER  ::=  { hashAlgs 18 }
>
>       ShakeOutputLen  ::=  INTEGER  -- Output length in bits
>
> On the other hand, id-shake256 has no parameters:
>
>       hashAlg-SHAKE256  ALGORITHM  ::=  { OID id-shake256 }
>
>       id-shake256  OBJECT IDENTIFIER  ::=  { hashAlgs 12 }
>
> I think this needs to get sorted out before draft-ietf-lamps-cms-shakes goes to IETF Last Call.

>From the algorithmic point of view, SHAKE digests can be truncated in
the traditional way. The truncated digest does not affect the output
of the hash. That is, a smaller digest size produces a prefix of a
longer one.

cSHAKE is different. The digest size affects the calculation of the
digest. Different digest sizes will produce different hashes, and the
prefix behavior does not hold.

The one area of confusion I have observed is, what is the default
output size of SHAKE-128 or SHAKE-256. For example, for SHAKE-128,
some libraries use 16, and some use 32 as the default digest size.

The SHAKE digest size is probably not needed as long as the digest
size is unambiguously stated for interop purposes.

Jeff