Re: [lamps] OID für KEM?

[Benjamin Kaduk <[e-mail]>]

On Sun, Oct 10, 2021 at 02:10:37PM -0400, Michael Richardson wrote:
> 
> Blumenthal, Uri - 0553 - MITLL <[e-mail]> wrote:
>     > On 10/8/21, 13:17, "Benjamin Kaduk" <[e-mail]> wrote:
>     > On Fri, Oct 08, 2021 at 01:13:01PM -0400, Russ Housley wrote:
>     >>> .  .  .  .  .  My worry is with the winning algorithms.
>     >>> I worry that implementations will have to support the
>     >>> researcher-assigned OID and the NIST-assigned OID.
>     >>
>     >> Sounds like what happened at https://github.com/openssl/openssl/pull/16594
>     >>
>     >> OpenSSL waited for the final SHA3 to implement, but then
>     >> got asked to also expose pre-standardization Keccak.
>     >> ^^^^
> 
>     > I acknowledge the concern that Russ expressed. But IMHO, it's
>     > inconvenient at worst. I see no reason to bend over backwards trying to
>     > avoid such a situation.
> 
> I also agree that it can be annoying, but I don't think that it's that huge a deal.
> It would be nice if this didn't happen, but it seems to me that integers are
> plentiful, and I think that we gain as a community from understanding how
> things work or didn't work.
> 
> As I understand Ben's comment, the "pre-standization Keccak" (and the
> unmodified Rijndael) are in fact different algorithms.

IIRC (not guaranteed), pre-standardization Keccak and SHA-3 differ in a few
constants, and the mapping between byte string and bit string, and are
definitely different algorithms.

> Ben didn't say what OpenSSL did.

The relevant policy body voted and approved an exception, so OpenSSL now
exposes pre-standardization Keccak as well as SHA-3.

-Ben