Re: [TLS] Ecdsa-sig-value in TLS 1.3 – need for erratum?

[Hubert Kario <[e-mail]>]

On Wednesday, 2 October 2019 13:18:07 CEST Hubert Kario wrote:
> On Tuesday, 1 October 2019 17:01:54 CEST Eric Rescorla wrote:
> > On Tue, Oct 1, 2019 at 5:27 AM John Mattsson <john.mattsson=
> > 
> > [e-mail]> wrote:
> > > Dan Brown <[e-mail]> wrote:
> > > > ANSI X9.62-2005 was withdrawn in 2015
> > > 
> > > Ok, that TLS 1.3 is relying on a withdrawn publication that used to be
> > > behind a paywall is even worse.
> > 
> > Ugh.
> > 
> > > > Also, I expect FIPS 186-5 is nearly ready, and will specify much of
> > > 
> > > ECDSA
> > > 
> > > That NIST FIPS 186-5 will include all the details needed to implement
> > > ECDSA is great.
> > > 
> > > >IETF has specs for sigs and their formats already, no?
> > > 
> > > At the time when RFC 8446 was published, there was probably no quick and
> > > easy solution to the problem. But the fact that IETF has historically
> > > been
> > > fine with relying on specifications behind paywalls is part of the
> > > problem.
> > > If IETF had implemented a strong open-access policy a long-time ago,
> > > there
> > > would probably be an open-access version of ECDSA (NIST or IETF) a long
> > > time ago..
> > 
> > I agree with you about the policy here. To be honest, I just didn't notice
> > this; and it would probably need some github spelunking to figure out the
> > history of these references.
> > 
> > If someone wanted to propose an erratum that would fix this, I would be
> > very appreciative.
> 
> I just did propose an erratum for that.

https://www.rfc-editor.org/errata/eid5868
-- 
Regards,
Hubert Kario
Senior Quality Engineer, QE BaseOS Security team
Web: www.cz.redhat.com
Red Hat Czech s.r.o., Purkyňova 115, 612 00  Brno, Czech Republic