Re: [TLS] Ecdsa-sig-value in TLS 1.3 – need for erratum?

[Dan Brown <[e-mail]>]

Re ECDSA specs and paywells:
ANSI X9.62-2005 was withdrawn in 2015, expiring automatically after 10 years, despite my weak effort.
A revival, ANSI X9.142, with almost the same content is under way, though even its fate is unsure.
Also, I expect FIPS 186-5 is nearly ready, and will specify much of ECDSA and EdDSA (not ASN.1?), which many may like (even better than ANSI).
Meanwhile, SEC1, versions 1.0 and 2.0, are available, fortunately or not, despite my weak effort.
IETF has specs for sigs and their formats already, no?
Then there's ISO, IEEE, ...


  Original Message  
From: John Mattsson
Sent: Tuesday, October 1, 2019 5:25 AM
To: Peter Gutmann; Hubert Kario; [e-mail]
Subject: Re: [TLS] Ecdsa-sig-value in TLS 1.3 – need for erratum?

Hubert Kario <[e-mail]> wrote:

> Now, I don't have access to X9.62-2005, but there's a possibility of confusion.

I think references to specifications behind paywalls and other types of limited access is a major problem. Not only for the standardization process, but also for researchers and implementors. In general, I think people should be able to implement and analyze IETF standards without having to pay for access.

Open-access is even more important for security specifications. ANSI X.62 is hopefully quite well-studied, but for other references, the lack of analysis often leads to mistakes and unknown weaknesses.

I would like the IETF to take a much stronger stance against normative references to paywalls. 

Cheers,
John

_______________________________________________
TLS mailing list
[e-mail]
https://urldefense.proofpoint.com/v2/url?u=https-3A__www.ietf.org_mailman_listinfo_tls&d=DwICAg&c=yzoHOc_ZK-sxl-kfGNSEvlJYanssXN3q-lhj0sp26wE&r=qkpbVDRj7zlSRVql-UonsW647lYqnsrbXizKI6MgkEw&m=A-9JTBh7dU_hCbOrrx-iACEmGPbjipnEohllYGLju6I&s=p2p9Y_hh-jb_qBNaNqTbSTYE2tAuJo-BaKDbemFVLxU&e=