Re: [TLS] Ecdsa-sig-value in TLS 1.3 – need for erratum?

[Hubert Kario <[e-mail]>]

On Tuesday, 1 October 2019 17:01:54 CEST Eric Rescorla wrote:
> On Tue, Oct 1, 2019 at 5:27 AM John Mattsson <john.mattsson=
> 
> [e-mail]> wrote:
> > Dan Brown <[e-mail]> wrote:
> > > ANSI X9.62-2005 was withdrawn in 2015
> > 
> > Ok, that TLS 1.3 is relying on a withdrawn publication that used to be
> > behind a paywall is even worse.
> 
> Ugh.
> 
> > > Also, I expect FIPS 186-5 is nearly ready, and will specify much of
> > 
> > ECDSA
> > 
> > That NIST FIPS 186-5 will include all the details needed to implement
> > ECDSA is great.
> > 
> > >IETF has specs for sigs and their formats already, no?
> > 
> > At the time when RFC 8446 was published, there was probably no quick and
> > easy solution to the problem. But the fact that IETF has historically been
> > fine with relying on specifications behind paywalls is part of the
> > problem.
> > If IETF had implemented a strong open-access policy a long-time ago, there
> > would probably be an open-access version of ECDSA (NIST or IETF) a long
> > time ago..
> 
> I agree with you about the policy here. To be honest, I just didn't notice
> this; and it would probably need some github spelunking to figure out the
> history of these references.
> 
> If someone wanted to propose an erratum that would fix this, I would be
> very appreciative.

I just did propose an erratum for that.

-- 
Regards,
Hubert Kario
Senior Quality Engineer, QE BaseOS Security team
Web: www.cz.redhat.com
Red Hat Czech s.r.o., Purkyňova 115, 612 00  Brno, Czech Republic