Re: [lamps] [EXTERNAL] [EXT] Re: WGLC for draft-ietf-lamps-cms-sha3-hash

Mike:

I have sent email to NIST to see whether they will assign OIDs for KMAC as a KDF as specified in NIST.SP.800-108r1. If so, I'm pleased to add another subsection to the draft for these KDFs.  They are more efficient that HKDF using SHA-3, but I'm not sure we should remove those sections.  There is a lot of adoption of HKDF in many different contexts.

Russ

> On Feb 7, 2024, at 12:06 PM, Mike Ounsworth <Mike.Ounsworth@entrust.com> wrote:
> 
> Russ,
>  
> I don’t think we’re talking about KMAC as a MAC – we’re talking about KMAC as a KDF, right?
>  
> draft-ietf-lamps-cms-sha3-hash Section 5: Key Derivation Functions lists
>  
> * HKDF with SHA3
> * KDF2 and KDF3 with SHA3
>  
> HKDF is HMAC underneath, which will be 2 invocations of SHA3. I don’t know what the KDF2 or KDF3 constructions are because I am not paying for the document.
>  
> KMAC is only a single invocation of SHA3, so I think this document would benefit from defining id-alg-kdf-kmac-128 and id-alg-kdf-kmac-256, with suitable instantiations of KMAC, in addition to the HKDF and KDF2 / KDF3 ones that are already in there.
>  
> Copying from my parallel email on this thread, there will be existing implementations of HKDF-SHA2 where the existing crypto agility easily allows for substitution of SHA2 for SHA3, but may not easily allow for substitution of the entire construction for KMAC, so I think there is value in leaving HKDF-SHA3 in.
>  
> ---
> Mike Ounsworth
>  
> From: Spasm <spasm-bounces@ietf.org <mailto:spasm-bounces@ietf.org>> On Behalf Of Russ Housley
> Sent: Wednesday, February 7, 2024 10:09 AM
> To: Uri Blumenthal <uri@ll.mit.edu <mailto:uri@ll.mit.edu>>
> Cc: Daniel Van Geest <daniel.vangeest.ietf@gmail.com <mailto:daniel.vangeest.ietf@gmail.com>>; SPASM <spasm@ietf.org <mailto:spasm@ietf.org>>
> Subject: [EXTERNAL] Re: [lamps] [EXT] Re: WGLC for draft-ietf-lamps-cms-sha3-hash
>  
> Uri: KMAC with SHAKE128 and KMAC with SHAKE256 are already specified for use as Message Authentication Codes in RFC 8702. Russ On Feb 7, 2024, at 10: 50 AM, Blumenthal, Uri - 0553 - MITLL <uri@ ll. mit. edu> wrote: > So then, are there 
> Uri:
>  
> KMAC with SHAKE128 and KMAC with SHAKE256 are already specified for use as Message Authentication Codes in RFC 8702.
>  
> Russ
>  
> On Feb 7, 2024, at 10:50 AM, Blumenthal, Uri - 0553 - MITLL <uri@ll.mit.edu <mailto:uri@ll.mit.edu>> wrote:
>  
> >   So then, are there any suggestions on what to do with this?  Keep hkdf-with-sha3* and make @Markku-Juhani O. Saarinen <mailto:mjos@pqshield.com> unhappy? 
>  
> I’m against it. I.e., count me as “unhappy” in this case too.
>  
> >  Slide KMAC into draft-ietf-lamps-cms-sha3-hash? Spin up a new draft for KMAC? 
>  
> Spinning up a new draft for KMAC sounds reasonable. I wouldn’t worry that it uses cSHAKE rather than SHA3.
>  
> >  Define an OID for KMAC in draft-ietf-lamps-cms-kyber (yuck)?
>  
> My gut feeling is “No”.
>  
> >  Force draft-ietf-lamps-cms-kyber to use KDF3 like rfc5990bis (and further commit to a paywalled spec)?
>  
> Absolutely not.
>  
>  
>  
> From: Spasm <spasm-bounces@ietf.org <mailto:spasm-bounces@ietf.org>> On Behalf Of Russ Housley
> Sent: Tuesday, February 6, 2024 8:51 PM
> To: Mike Ounsworth <Mike.Ounsworth=40entrust.com@dmarc.ietf.org <mailto:Mike.Ounsworth=40entrust.com@dmarc.ietf.org>>; Markku-Juhani O. Saarinen <mjos@pqshield.com <mailto:mjos@pqshield.com>>
> Cc: Tim Hollebeek <tim.hollebeek=40digicert.com@dmarc.ietf.org <mailto:tim.hollebeek=40digicert.com@dmarc.ietf.org>>; SPASM <spasm@ietf.org <mailto:spasm@ietf.org>>
> Subject: Re: [lamps] WGLC for draft-ietf-lamps-cms-sha3-hash
>  
> Mike and Markku:
>  
> Section 5 was added in October 2023because someone asked for KDFs.  I do not recall the source of the request.
>  
> Russ
> 
> 
> 
> 
> On Feb 6, 2024, at 3:21 PM, Mike Ounsworth <Mike.Ounsworth=40entrust.com@dmarc.ietf.org <mailto:Mike.Ounsworth=40entrust.com@dmarc.ietf.org>> wrote:
>  
> Sorry, too quick on the SEND.
>  
> Markku is questioning why we need section 5.1 HKDF with SHA3.
>  
> ---
> Mike Ounsworth
>  
> From: Spasm <spasm-bounces@ietf.org <mailto:spasm-bounces@ietf.org>> On Behalf Of Mike Ounsworth
> Sent: Tuesday, February 6, 2024 2:20 PM
> To: Tim Hollebeek <tim.hollebeek=40digicert.com@dmarc.ietf.org <mailto:tim.hollebeek=40digicert.com@dmarc.ietf.org>>; SPASM <spasm@ietf.org <mailto:spasm@ietf.org>>; Markku-Juhani O. Saarinen <mjos@pqshield.com <mailto:mjos@pqshield.com>>
> Subject: [EXTERNAL] Re: [lamps] WGLC for draft-ietf-lamps-cms-sha3-hash
>  
> I’m just gonna lob this in on @Markku-Juhani O. Saarinen <mailto:mjos@pqshield.com>’s behalf.
>  
> He commented this morning that it’s un-necessary to do HMAC with SHA3. If you need a MAC, then KMAC is a single invocation of SHA3 vs two invocations in HMAC. And if you only need a KDF then (I think?) naked SHA3 is fine?
>  
> I’ll leave it to Markku to give the details here, but I wanted to make sure this got logged before WGLC closes.
>  
> ---
> Mike Ounsworth
>  
> From: Spasm <spasm-bounces@ietf.org <mailto:spasm-bounces@ietf.org>> On Behalf Of Tim Hollebeek
> Sent: Tuesday, January 30, 2024 2:43 PM
> To: SPASM <spasm@ietf.org <mailto:spasm@ietf.org>>
> Subject: [EXTERNAL] [lamps] WGLC for draft-ietf-lamps-cms-sha3-hash
>  
> Hello,
>  
> Russ has suggested that draft-ietf-lamps-cms-sha3-hash might be ready for WGLC, and since it’s a pretty simple draft that seems like a pretty reasonable way to flush out any remaining comments and problems.
>  
> Therefore this is the WGLC for draft-ietf-lamps-cms-sha3-hash:
>  
> Use of the SHA3 One-way Hash Functions in the Cryptographic Message Syntax (CMS)
> https://datatracker.ietf.org/doc/draft-ietf-lamps-cms-sha3-hash/ <https://urldefense.com/v3/__https:/datatracker.ietf.org/doc/draft-ietf-lamps-cms-sha3-hash/__;!!FJ-Y8qCqXTj2!byPxBYPVZ9FW0iY4xIILY8VaxAuB50r17Pl74_V6yeLZ_6u55BDl5iFwdWmHwTM2b_3cIFpu-ktMwth2YQnANtgAaDTb$>
>  
> Abstract
>  
>    This document describes the conventions for using the four one-way
>    hash functions in the SHA3 family with the Cryptographic Message
>    Syntax (CMS).
>  
> Please send comments to the list by 12 February 2024.
>  
> -Tim
>  
> _______________________________________________
> Spasm mailing list
> Spasm@ietf.org <mailto:Spasm@ietf.org>
> https://www.ietf.org/mailman/listinfo/spasm <https://urldefense.com/v3/__https:/www.ietf.org/mailman/listinfo/spasm__;!!FJ-Y8qCqXTj2!byPxBYPVZ9FW0iY4xIILY8VaxAuB50r17Pl74_V6yeLZ_6u55BDl5iFwdWmHwTM2b_3cIFpu-ktMwth2YQnANlKRxjq-$>
>  
> _______________________________________________
> Spasm mailing list
> Spasm@ietf.org <mailto:Spasm@ietf.org>
> https://www.ietf.org/mailman/listinfo/spasm <https://urldefense.com/v3/__https:/www.ietf.org/mailman/listinfo/spasm__;!!FJ-Y8qCqXTj2!byPxBYPVZ9FW0iY4xIILY8VaxAuB50r17Pl74_V6yeLZ_6u55BDl5iFwdWmHwTM2b_3cIFpu-ktMwth2YQnANlKRxjq-$>