Subject: RE: Adding GOST as a cipher?

From: "Vlad \"SATtva\" Miller" <[email-masked]>
Date: Fri, 21 Jan 2005 09:18:24 +0600

Jon Callas wrote:
> Recently, I've been asked about adding GOST as a cipher into OpenPGP.
> It's needed in Russia and parts of Eastern Europe, where they use it in
> banking and government applications.

This won't help much unless you also consider specifying GOST R 34.11-94
(based on GOST 28147-89 block cipher) for hash function and GOST R 34.19-2001
(based on elliptic curves) for digital signature. These are the only permitted
algorithms for banking/government use in Russia. Don't know about other
Eastern Eaurope countries policies, though.

Ian G wrote:
> It would however be a nuisance if it was "rushed in"
> only to find out later that it is ... not quite right.  I
> gather there are rather a lot of options behind the
> simple 'GOST' word?  Is this the algorithm where
> the S-Boxes aren't specified in the standard?

Nope, the GOST S-boxes are specified directly in russian GOST (Government
Standard) 28147-89.

 Vladislav "SATtva" Miller
 "PGP in Russia" project leader
 http://www.pgpru.com

---

From: [email-masked] (Peter Gutmann)
Date: Sat, 22 Jan 2005 01:56:37 +1300

Ian G <[email-masked]> writes:

>That's the sort of information we need.  Is that sufficient to create the
>paramaters and specify them in the standard?

I don't really know how necessary this would be in practice.  S/MIME (which
Jon referred to in his original message) has a couple of algorithms in there
that were added due to various national requirements where the understanding
is that those who feel compelled to support the Wombat128 algorithm will know
the details of Wombat128 and don't need much in the RFC beyond an ID.  Because
of this the S/MIME approach is to have a distinct RFC for each NIH algorithm
that copies 10 pages of boilerplate from the previous NIH algorithm RFC and
then changes a few sentences to say "Use this ID".  I think this would be the
best approach for OpenPGP as well.  We're well into the political layer here,
not much to do with technology any more.

Peter.

---

From: Ian G <[email-masked]>
Date: Fri, 21 Jan 2005 12:39:43 +0000

>Eastern Eaurope countries policies, though.

That's the sort of information we need.  Is that
sufficient to create the paramaters and specify
them in the standard?

Another issue is implementations.  Is it appropriate
to get a couple of cooperating code bases in action
before they get added to the standard?

> ...
>
> the GOST S-boxes are specified directly in russian GOST (Government
>Standard) 28147-89.
>  
>

-- 
News and views on what matters in finance+crypto:
        http://financialcryptography.com/

---

From: "Vlad \"SATtva\" Miller" <[email-masked]>
Date: Fri, 21 Jan 2005 20:06:31 +0600

> Nope, the GOST S-boxes are specified directly in russian GOST (Government

Sorry, it was my mistake. S-boxes indeed aren't specified in the document, and
are considered as an "additional" key (they must be kept in secret, and may be
generated using RNG).

---

From: Lutz Donnerhacke <[email-masked]>
Date: Fri, 21 Jan 2005 14:37:37 +0000 (UTC)

* Vlad  SATtva  Miller wrote:
> Sorry, it was my mistake. S-boxes indeed aren't specified in the
> document, and are considered as an "additional" key (they must be kept in
> secret, and may be generated using RNG).

So the system has not changed. It's shown, that random S-boxes are less
secure than those of DES. Too bad.

Thanx for the material, I'll read through.

---

From: Ian G <[email-masked]>
Date: Fri, 21 Jan 2005 23:05:53 +0000

Vlad "SATtva" Miller wrote:

>algorithms for banking/government use in Russia.
>

Do they specify a public key encryption
algorithm?

iang

---

From: "Vlad \"SATtva\" Miller" <[email-masked]>
Date: Sat, 22 Jan 2005 05:08:35 +0600

> >(based on GOST 28147-89 block cipher) for hash function and GOST R

I'm now trying to figure it out. Oddly, there is no GOST standard for PK. RSA
is used often enough in banking sector, but banks have less strict
regulations, and even using 3DES. That's not an issue for government
organisations though. I'll give an answer on PK in day or two.

---

From: Ian G <[email-masked]>
Date: Mon, 24 Jan 2005 11:26:30 +0000

Vlad "SATtva" Miller wrote:

>From: Ian G
>>>(based on GOST 28147-89 block cipher) for hash function and GOST R
>>>      
>>>
>>34.19-2001
>>    
>>
>>>(based on elliptic curves) for digital signature. These are the
>>>      
>>>
>>only permitted
>>    
>>
>Ok, here are results of my research on that matter. There in no
>government-proposed public key encryption in Russia as there was no sex in the
>USSR. :) For symmetric encryption and MACs GOSTs 28147-89 and R 34.11-94 are
>being used, but as to the session key generation from public key certificates
>(probably in DH key exchange), there is no such unclassified common specs, and
>it's supposed that each implementation needs to be scrutinized in the
>certification body (FSB currently, Russian Federal Security Service) on the
>individual basis to be approved.
>  
>

So it would appear that for this to be a viable
project, the ecnryption, the hash, and the digsig
in GOST form would all need to be implemented,
and a secret key exchange method chosen.

Is there a team willing to specify those in OpenPGP
form, and are there two implementations willing
to code them up and do some interop testing?

If that were the case, I suppose we could think
in terms of pencilling in the numbers, but I don't
see that there is much point in allocating them
in the draft, given our emphasis on cleaning out
cruft rather than adding it in.

I still think it's a worthwhile project to encourage
though.  Perhaps the users could consider using
OpenPGP in non-standard modes while waiting
for the implementations...

( Hal, what did you think of the triple GOST idea?
Are three ghosts scarier than one?  ;)

iang

---

From: "Vlad \"SATtva\" Miller" <[email-masked]>
Date: Mon, 24 Jan 2005 17:08:06 +0600

From: Ian G

---

From: "Vlad \"SATtva\" Miller" <[email-masked]>
Date: Mon, 24 Jan 2005 18:44:39 +0600

> Are three ghosts scarier than one?  ;)

Please bear in mind that some of my precautions regarding GOST cipher strength
was a little overdo. To this day all attacks against the cipher remains fully
theoretical, and no practical weakness has been demonstrated. That will not
last for eternity, however. I think, we need a more detailed evaluation of its
current state before implementing it in three-encryption mode. I cannot
recommend any domestic literature on the topic -- most of it is heavily
biased.