Re: [TLS] Requesting working group adoption of draft-stebila-tls-hybrid-design

Stephen Farrell <stephen.farrell@cs.tcd.ie> Wed, 12 February 2020 23:52 UTC

Return-Path: <stephen.farrell@cs.tcd.ie>
X-Original-To: tls@ietfa.amsl.com
Delivered-To: tls@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6F65C12002F for <tls@ietfa.amsl.com>; Wed, 12 Feb 2020 15:52:36 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -4.299
X-Spam-Level:
X-Spam-Status: No, score=-4.299 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cs.tcd.ie
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 9da_DqMPwnv2 for <tls@ietfa.amsl.com>; Wed, 12 Feb 2020 15:52:33 -0800 (PST)
Received: from mercury.scss.tcd.ie (mercury.scss.tcd.ie [134.226.56.6]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 9CCDC120019 for <tls@ietf.org>; Wed, 12 Feb 2020 15:52:33 -0800 (PST)
Received: from localhost (localhost [127.0.0.1]) by mercury.scss.tcd.ie (Postfix) with ESMTP id 76C86BE39; Wed, 12 Feb 2020 23:52:31 +0000 (GMT)
X-Virus-Scanned: Debian amavisd-new at scss.tcd.ie
Received: from mercury.scss.tcd.ie ([127.0.0.1]) by localhost (mercury.scss.tcd.ie [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 5bzJda0Dxm0E; Wed, 12 Feb 2020 23:52:29 +0000 (GMT)
Received: from [10.244.2.119] (95-45-153-252-dynamic.agg2.phb.bdt-fng.eircom.net [95.45.153.252]) by mercury.scss.tcd.ie (Postfix) with ESMTPSA id 81EB1BE2E; Wed, 12 Feb 2020 23:52:29 +0000 (GMT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cs.tcd.ie; s=mail; t=1581551549; bh=rGc/rk9cMWo33GdiJxJX1n+kIsnB7wEswlgRSCHrg8U=; h=Subject:To:References:From:Date:In-Reply-To:From; b=E0KjaSBepnFfUSosrAdhuHbyCsfyabLQblGOU4Nm2MrsLWE4SwSdYLV+LTQnFKesP MBZt4XP/y1lbCh+pONvNiAdoRegylYCZsQjIqRgAQmzH5JbWtlORfQur5C5AtLcLE+ wuvn6JmnytpfRjm3k45jYlSaJj+5lrscylqNzcXE=
To: "Blumenthal, Uri - 0553 - MITLL" <uri@ll.mit.edu>, Martin Thomson <mt@lowentropy.net>, "tls@ietf.org" <tls@ietf.org>
References: <CAFBh+SRAJAbviyrcQM2PjztumAH565i4-ui28OQ-pCJE9nePJg@mail.gmail.com> <284685f0-8b19-4870-aef6-573809827091@www.fastmail.com> <CDADA8F3-65EA-4002-B7B7-7F3798BB331B@ll.mit.edu> <540a1632-5e0e-4aac-b9d0-8fac6b8f06be@www.fastmail.com> <00015213-5a87-7275-67b1-aade6cc5ed8c@cs.tcd.ie> <F4D9DA29-D029-4BE2-80BC-BE3777F0142E@ll.mit.edu>
From: Stephen Farrell <stephen.farrell@cs.tcd.ie>
Autocrypt: addr=stephen.farrell@cs.tcd.ie; prefer-encrypt=mutual; keydata= mQINBFo9UDIBEADUH4ZPcUnX5WWRWO4kEkHea5Y5eEvZjSwe/YA+G0nrTuOU9nemCP5PMvmh 5Cg8gBTyWyN4Z2+O25p9Tja5zUb+vPMWYvOtokRrp46yhFZOmiS5b6kTq0IqYzsEv5HI58S+ QtaFq978CRa4xH9Gi9u4yzUmT03QNIGDXE37honcAM4MOEtEgvw4fVhVWJuyy3w//0F2tzKr EMjmL5VGuD/Q9+G/7abuXiYNNd9ZFjv4625AUWwy+pAh4EKzS1FE7BOZp9daMu9MUQmDqtZU bUv0Q+DnQAB/4tNncejJPz0p2z3MWCp5iSwHiQvytYgatMp34a50l6CWqa13n6vY8VcPlIqO Vz+7L+WiVfxLbeVqBwV+4uL9to9zLF9IyUvl94lCxpscR2kgRgpM6A5LylRDkR6E0oudFnJg b097ZaNyuY1ETghVB5Uir1GCYChs8NUNumTHXiOkuzk+Gs4DAHx/a78YxBolKHi+esLH8r2k 4LyM2lp5FmBKjG7cGcpBGmWavACYEa7rwAadg4uBx9SHMV5i33vDXQUZcmW0vslQ2Is02NMK 7uB7E7HlVE1IM1zNkVTYYGkKreU8DVQu8qNOtPVE/CdaCJ/pbXoYeHz2B1Nvbl9tlyWxn5Xi HzFPJleXc0ksb9SkJokAfwTSZzTxeQPER8la5lsEEPbU/cDTcwARAQABtDJTdGVwaGVuIEZh cnJlbGwgKDIwMTcpIDxzdGVwaGVuLmZhcnJlbGxAY3MudGNkLmllPokCQAQTAQgAKgIbAwUJ CZQmAAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAUCWj6jdwIZAQAKCRBasvrxexcr6o7QD/9m x9DPJetmW794RXmNTrbTJ44zc/tJbcLdRBh0KBn9OW/EaAqjDmgNJeCMyJTKr1ywaps8HGUN hLEVkc14NUpgi4/Zkrbi3DmTp25OHj6wXBS5qVMyVynTMEIjOfeFFyxG+48od+Xn7qg6LT7G rHeNf+z/r0v9+8eZ1Ip63kshQDGhhpmRMKu4Ws9ZvTW2ACXkkTFaSGYJj3yIP4R6IgwBYGMz DXFX6nS4LA1s3pcPNxOgrvCyb60AiJZTLcOk/rRrpZtXB1XQc23ZZmrlTkl2HaThL6w3YKdi Ti1NbuMeOxZqtXcUshII45sANm4HuWNTiRh93Bn5bN6ddjgsaXEZBKUBuUaPBl7gQiQJcAlS 3MmGgVS4ZoX8+VaPGpXdQVFyBMRFlOKOC5XJESt7wY0RE2C8PFm+5eywSO/P1fkl9whkMgml 3OEuIQiP2ehRt/HVLMHkoM9CPQ7t6UwdrXrvX+vBZykav8x9U9M6KTgfsXytxUl6Vx5lPMLi 2/Jrsz6Mzh/IVZa3xjhq1OLFSI/tT2ji4FkJDQbO+yYUDhcuqfakDmtWLMxecZsY6O58A/95 8Qni6Xeq+Nh7zJ7wNcQOMoDGj+24di2TX1cKLzdDMWFaWzlNP5dB5VMwS9Wqj1Z6TzKjGjru q8soqohwb2CK9B3wzFg0Bs1iBI+2RuFnxLkCDQRaPVAyARAA+g3R0HzGr/Dl34Y07XqGqzq5 SU0nXIu9u8Ynsxj7gR5qb3HgUWYEWrHW2jHOByXnvkffucf5yzwrsvw8Q8iI8CFHiTYHPpey 4yPVn6R0w/FOMcY70eTIu/k6EEFDlDbs09DtKcrsT9bmN0XoRxITlXwWTufYqUnmS+YkAuk+ TLCtUin7OdaS2uU6Ata3PLQSeM2ZsUQMmYmHPwB9rmf+q2I005AJ9Q1SPQ2KNg/8xOGxo13S VuaSqYRQdpV93RuCOzg4vuXtR+gP0KQrus/P2ZCEPvU9cXF/2MIhXgOz207lv3iE2zGyNXld /n8spvWk+0bH5Zqd9Wcba/rGcBhmX9NKKDARZqjkv/zVEP1X97w1HsNYeUFNcg2lk9zQKb4v l1jx/Uz8ukzH2QNhU4R39dbF/4AwWuSVkGW6bTxHJqGs6YimbfdQqxTzmqFwz3JP0OtXX5q/ 6D4pHwcmJwEiDNzsBLl6skPSQ0Xyq3pua/qAP8MVm+YxCxJQITqZ8qjDLzoe7s9X6FLLC/DA L9kxl5saVSfDbuI3usH/emdtn0NA9/M7nfgih92zD92sl1yQXHT6BDa8xW1j+RU4P+E0wyd7 zgB2UeYgrp2IIcfG+xX2uFG5MJQ/nYfBoiALb0+dQHNHDtFnNGY3Oe8z1M9c5aDG3/s29QbJ +w7hEKKo9YMAEQEAAYkCJQQYAQgADwUCWj1QMgIbDAUJCZQmAAAKCRBasvrxexcr6qwvD/9b Rek3kfN8Q+jGrKl8qwY8HC5s4mhdDJZI/JP2FImf5J2+d5/e8UJ4fcsT79E0/FqX3Z9wZr6h sofPqLh1/YzDsYkZDHTYSGrlWGP/I5kXwUmFnBZHzM3WGrL3S7ZmCYMdudhykxXXjq7M6Do1 oxM8JofrXGtwBTLv5wfvvygJouVCVe87Ge7mCeY5vey1eUi4zSSF1zPpR6gg64w2g4TXM5qt SwkZVOv1g475LsGlYWRuJV8TA67yp1zJI7HkNqCo8KyHX0DPOh9c+Sd9ZX4aqKfqH9HIpnCL AYEgj7vofeix7gM3kQQmwynqq32bQGQBrKJEYp2vfeO30VsVx4dzuuiC5lyjUccVmw5D72J0 FlGrfEm0kw6D1qwyBg0SAMqamKN6XDdjhNAtXIaoA2UMZK/vZGGUKbqTgDdk0fnzOyb2zvXK CiPFKqIPAqKaDHg0JHdGI3KpQdRNLLzgx083EqEc6IAwWA6jSz+6lZDV6XDgF0lYqAYIkg3+ 6OUXUv6plMlwSHquiOc/MQXHfgUP5//Ra5JuiuyCj954FD+MBKIj8eWROfnzyEnBplVHGSDI ZLzL3pvV14dcsoajdeIH45i8DxnVm64BvEFHtLNlnliMrLOrk4shfmWyUqNlzilXN2BTFVFH 4MrnagFdcFnWYp1JPh96ZKjiqBwMv/H0kw==
Message-ID: <d19b4fbe-5dbc-5045-1ce3-951ee97256d2@cs.tcd.ie>
Date: Wed, 12 Feb 2020 23:52:28 +0000
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Thunderbird/68.4.1
MIME-Version: 1.0
In-Reply-To: <F4D9DA29-D029-4BE2-80BC-BE3777F0142E@ll.mit.edu>
Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="e3vYkTDBJpaCvrc72adIz7GLuLfkHGxrP"
Archived-At: <https://mailarchive.ietf.org/arch/msg/tls/4AnxzRtFdZobx5iRO1S41HTWjvE>
Subject: Re: [TLS] Requesting working group adoption of draft-stebila-tls-hybrid-design
X-BeenThere: tls@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." <tls.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/tls>, <mailto:tls-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/tls/>
List-Post: <mailto:tls@ietf.org>
List-Help: <mailto:tls-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/tls>, <mailto:tls-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 12 Feb 2020 23:52:36 -0000

Hiya,

On 12/02/2020 22:57, Blumenthal, Uri - 0553 - MITLL wrote:
> I don't expect you to be knowledgeable about 25+ proposed 
> algorithms.

I didn't mean it was you forcing that on me, but if you
want to give it a shot... :-)

> 
> I expect you to be knowledgeable about the ballpark of the new key 
> sizes that practically all of the candidates use. The shortest keys 
> are in the ballpark of a few KB, and I won't go into the size of the 
> largest ones.

Sorry but my understanding is that there are relatively
complicated combinations involving both performance and
sizes of the various PDUs and stored keys involved. I don't
think it'd be a good plan to specify how to handle that
on the Internet until the details are better known and
understood and the set of possible options is small enough
to be sensibly evaluated in detail. IMO, we're not there
yet. (And I'll bet a beer that even after we have 'em,
each of the "winners" arrives with 5 or so variants;-()

> 
> You may not want to *adopt* them now - but you better be ready to 
> support Key Exchange for sizes far larger than what's currently 
> implemented. And keep in mind that while Signatures aren't a
> priority yet, that will come eventually.

We knew that years ago. The sky hasn't fallen yet. I
doubt it'll fall in the next 12-18 months. In contrast
I would not be at all surprised to find we'd made a
well-meaning mistake in trying to standardise this
stuff in the absence of a broad understanding of the
detail.

Maybe putting it another way might help: my experience
is that the worst work I've done involved such ignorance
and what I think of as the less bad work I've done did
not. Maybe others are better than me at dealing with
"known unknowns" though, though IIRC the circumstances
that lead to that phrase didn't pan out as well as had
been hoped.

And one minor addendum:

On 12/02/2020 23:41, Watson Ladd wrote:
> What's the point of composite schemes after the NIST competition 
> finishes?

SHA-0:-)

Cheers,
S.


> 
> 
> 
> ´╗┐On 2/12/20, 5:50 PM, "Stephen Farrell" <stephen.farrell@cs.tcd.ie>; 
> wrote:
> 
> Hiya,
> 
> On 12/02/2020 21:57, Martin Thomson wrote:
>> Only a few of them.  Some are OK, but the number is few, I agree. I
>> haven't found a good summary of the second round candidates and I
>> don't have time to dig into all of the candidates.
> 
> Fine reason to wait and see IMO.
> 
> I'd be much happier adopting this if we did that with the explicit 
> understanding that we won't produce an RFC until the "winners" in
> the NIST process are known and their properties understood. (I don't
> mean waiting for a FIPS or formal NIST document but at least for the
> final announcement from their process.)
> 
> If the plan were to adopt this and produce an RFC now (e.g. to mix 
> different curves or something) then I am against that. There's no 
> need for such combinations so the real rationale here is PQC and we 
> (at least I, but I suspect also many IETF participants) don't know 
> enough about the relevant algorithms yet. (And expecting us to be 
> knowledgeable about 25+ algorithms isn't realistic.)
> 
> Cheers, S.
> 
> 
>