Re: [Trans] Policy for adding to IANA registries requested in 6962-bis

Bill Frantz <frantz@pwpconsult.com> Wed, 14 December 2016 00:20 UTC

Return-Path: <frantz@pwpconsult.com>
X-Original-To: trans@ietfa.amsl.com
Delivered-To: trans@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 28AB81294EC for <trans@ietfa.amsl.com>; Tue, 13 Dec 2016 16:20:32 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.62
X-Spam-Level:
X-Spam-Status: No, score=-2.62 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01] autolearn=ham autolearn_force=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 6yDKu6NkKodQ for <trans@ietfa.amsl.com>; Tue, 13 Dec 2016 16:20:30 -0800 (PST)
Received: from elasmtp-galgo.atl.sa.earthlink.net (elasmtp-galgo.atl.sa.earthlink.net [209.86.89.61]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 01D21129A03 for <trans@ietf.org>; Tue, 13 Dec 2016 16:20:29 -0800 (PST)
Received: from [47.143.125.162] (helo=Williams-MacBook-Pro.local) by elasmtp-galgo.atl.sa.earthlink.net with esmtpa (Exim 4.67) (envelope-from <frantz@pwpconsult.com>) id 1cGxIo-0004mE-Np; Tue, 13 Dec 2016 19:20:10 -0500
Date: Tue, 13 Dec 2016 16:20:10 -0800
From: Bill Frantz <frantz@pwpconsult.com>
To: Andrew Ayer <agwa@andrewayer.name>
X-Priority: 3
In-Reply-To: <20161213155917.195a6b88a726c74cc320d7df@andrewayer.name>
Message-ID: <r470Ps-10121i-019CF7E50A5744F38D78ABB70C8C48F5@Williams-MacBook-Pro.local>
MIME-Version: 1.0
Content-Type: text/plain; charset="UTF-8"; format="flowed"
Content-Transfer-Encoding: quoted-printable
X-Mailer: Mailsmith 2.4 (470)
X-ELNK-Trace: 3a5e54fa03f1b3e21aa676d7e74259b7b3291a7d08dfec79f478480cc4a34e03554b6b970a3dbf19350badd9bab72f9c350badd9bab72f9c350badd9bab72f9c
X-Originating-IP: 47.143.125.162
Archived-At: <https://mailarchive.ietf.org/arch/msg/trans/w7xCZYF9lsXy6F5e9aBz3uVaJH4>
Cc: Eran Messeri <eranm@google.com>, trans@ietf.org
Subject: Re: [Trans] Policy for adding to IANA registries requested in 6962-bis
X-BeenThere: trans@ietf.org
X-Mailman-Version: 2.1.17
Precedence: list
List-Id: Public Notary Transparency working group discussion list <trans.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/trans>, <mailto:trans-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/trans/>
List-Post: <mailto:trans@ietf.org>
List-Help: <mailto:trans-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/trans>, <mailto:trans-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 14 Dec 2016 00:20:32 -0000

On 12/13/16 at 3:59 PM, agwa@andrewayer.name (Andrew Ayer) wrote:

>On Tue, 13 Dec 2016 14:32:04 +0000
>Eran Messeri <eranm@google.com> wrote:
>
>>* For Hash Algorithm repository, specify "Expert Review" guiding the
>>Expert to make sure the proposed hash algorithm has public
>>specification and does not suffer from known preimage attacks.
>
>The hash algorithm also needs collision resistance.
>
>How precise does the guidance need to be?  "Not suffer from known
>preimage attacks" wouldn't be construed as forbidding SHA-2 because
>there are some very expensive preimage attacks on some rounds, would it?
>
>Arguably, "suitable for use as a cryptographic hash function" covers
>both preimage and collision resistance, and leaves it to the expert's
>discretion what attacks are worth worrying about.  Would leaving it at
>this provide sufficient guidance?

It might be better to specifically mention the characteristics 
known to be needed along with some general guidance which leans 
on the reviewer's expertise. Perhaps:

"Suitable for use as a cryptographic hash with no known preimage 
or collision attacks. These attacks can damage the integrity of 
the log."

Cheers - Bill

------------------------------------------------------------------------
Bill Frantz        |"Insofar as the propositions of mathematics 
refer to
408-356-8506       | reality, they are not certain; and insofar 
they are
www.pwpconsult.com | certain, they do not refer to reality.” 
-- Einstein