Subject: Adding GOST as a cipher?

From: Jon Callas <[email-masked]>
Date: Thu, 20 Jan 2005 15:48:27 -0800

Recently, I've been asked about adding GOST as a cipher into OpenPGP. 
It's needed in Russia and parts of Eastern Europe, where they use it in 
banking and government applications.

Is there an objection to finding out what the right thing to do is, and 
putting it in the draft? This really consists of allocating an 
identifier for it, and specifying the parameters. I'd look to what 
they're doing in an S/MIME draft for the right thing.

Without this, the people who need to do it are going to push it into 
the private/experimental range, which is not the right thing, nor 
scalable.

	Jon

---

From: Ian G <[email-masked]>
Date: Fri, 21 Jan 2005 00:53:36 +0000

Jon Callas wrote:

> It's needed in Russia and parts of Eastern Europe, where they use it 
> in banking and government applications.

I gather that there are regulations that state that
only GOST is permitted to be used.  (Beyond that, I
don't know any more.)

> Is there an objection to finding out what the right thing to do is, 
> and putting it in the draft? This really consists of allocating an 

The only objection I would have is if it help up the
draft.  If something else is holding up the draft, no
problems.

It would however be a nuisance if it was "rushed in"
only to find out later that it is ... not quite right.  I
gather there are rather a lot of options behind the
simple 'GOST' word?  Is this the algorithm where
the S-Boxes aren't specified in the standard?

> the private/experimental range, which is not the right thing, nor 

( There's no reason why they can't get it going in the
private/exp range and then when they are happy,
ask for allocation.  That's what it's for, really.  But,
whatever.... )

-- 
News and views on what matters in finance+crypto:
        http://financialcryptography.com/

---

From: Lutz Donnerhacke <[email-masked]>
Date: Fri, 21 Jan 2005 08:27:52 +0000 (UTC)

* Ian G wrote:
> It would however be a nuisance if it was "rushed in" only to find out
> later that it is ... not quite right.  I gather there are rather a lot of
> options behind the simple 'GOST' word?  Is this the algorithm where the
> S-Boxes aren't specified in the standard?

Exactly. GOST is assumed to be more vulnerable than DES.

---

From: Lutz Donnerhacke <[email-masked]>
Date: Fri, 21 Jan 2005 08:47:21 +0000 (UTC)

> Exactly. GOST is assumed to be more vulnerable than DES.

It seems to be changed in the past. I try to get the standards in order to
quickly evaluate the usefulness.

---

From: "Vlad \"SATtva\" Miller" <[email-masked]>
Date: Fri, 21 Jan 2005 18:26:34 +0600

In case somebody is interested in more information, here are some references:

Original GOST 28147-89 cipher specs translated in English
http://vipul.net/gost/papers/gost-spec.ps.gz
http://vipul.net/gost/papers/russian-des.ps.gz
GOST 28147-89 mathematical analysis
http://vipul.net/gost/papers/further-comments.ps.gz

Original GOST R 34.11-94 hash algorithm specs translated in English
http://www.cl.cam.ac.uk/users/mrr/gost/gost34.11.dvi (incomplete)
C implementation and test vectors
http://www.tcs.hut.fi/~mjos/gosthash.tar.gz

Additional cryptographic algorithms for use with GOST 28147-89, GOST R
34.10-94, GOST R 34.10-2001, and GOST R 34.11-94 algorithms (Vladimir Popov,
Igor Kurepkin, Serguei Leontiev)
http://cnscenter.future.co.kr/resource/ietf/ind-draft/draft-popov-cryptopro-cp
algs-01.txt

Many GOST documents translations for a reasonable prices
http://www.eastview.com/xq/ASP/ics_code=35.040/f_start_value=1/f_ml=20/browse_
order=gost_english/browse_order_asc=asc/f_locale=_cyr/qx/russian/standards/bro
wse_standard.asp

IAIK-JCE API GOST Java implementation
http://jce.iaik.tugraz.at/products/01_jce/documentation/javadoc/iaik/security/
cipher/GOST.html

Respectfully yours,

 Vladislav "SATtva" Miller
 http://www.pgpru.com

---

From: Ian G <[email-masked]>
Date: Fri, 21 Jan 2005 12:44:15 +0000

>Exactly. GOST is assumed to be more vulnerable than DES.

Hmmm... What is our take on adding an algorithm
less well respected than DES?  It was never considered
as being useful in the past.

Perhaps the fine line is walked by saying that the
paramaters get added but there is a warning that
there are security issues with the algorithms, and
they become a MAY implement, for markets that
have regulatory requirements?

Once upon a time, PGP was the tool of cryptorebels.
These days however, it is not their sole preserve.
Are clients and preferences up to allowing two
opposing communities to co-exist in peace?

iang

---

From: Adrian von Bidder <[email-masked]>
Date: Fri, 21 Jan 2005 15:00:01 +0100

On Friday 21 January 2005 01.53, Ian G wrote:

> only to find out later that it is ... not quite right.

Perhaps 'rush in' an ID (or a couple of IDs, as per Vlad Miller's mail) with 
reference to it being the sole legally useful algorithm for some 
applications in russia, with all details to be ironed out in another 
document?

The big potential problem with this is conflicting non-compatible 
implementations.

So perhaps using an id from the experimental range would still be best for 
now; transition to a regular id shouldn't be a problem later on, apart from 
the time it takes.

greetings
-- vbi

-- 
Beware of the FUD - know your enemies. This week
    * Patent Law, and how it is currently abused. *
http://fortytwo.ch/opinion

---

From: David Shaw <[email-masked]>
Date: Fri, 21 Jan 2005 11:13:15 -0500

> applications in russia, with all details to be ironed out in another 

I'm taking a wait and see attitude with regards to GOST itself, but I
am against sticking in an ID without details.  Whether in 2440bis or
in another document, we should either do GOST or not do GOST.  The
halfway thing doesn't really help anyone.

A few months back we actually removed some 'IDs without details' from
the draft.

David

---

From: Ian G <[email-masked]>
Date: Fri, 21 Jan 2005 17:50:48 +0000

>A few months back we actually removed some 'IDs without details' from

So the test might be that even though 2440bis does
not describe the paramaters/details, it should have
a reference to where they *are* definitively stated,
to the extent that any implementation can create an
OpenPGP compatible plugin with that algorithm.

I must admit, if these details are not laid down
somewhere, I'm unsure what the point of adding
the Id into 2440bis is.  If there is a risk that this
could end up pointing to separate implementations,
then that would indicate that we had put the cart
before the horse?

iang

---

From: David Shaw <[email-masked]>
Date: Fri, 21 Jan 2005 13:06:52 -0500

On Fri, Jan 21, 2005 at 05:50:48PM +0000, Ian G wrote:

> >I'm taking a wait and see attitude with regards to GOST itself, but
> >I am against sticking in an ID without details.  Whether in 2440bis
> >or in another document, we should either do GOST or not do GOST.
> >The halfway thing doesn't really help anyone.
> >
> >A few months back we actually removed some 'IDs without details'
> >from the draft.
> > 
> 

Not even that.  There is no need to split details between two
documents.  If we're going to do GOST, put it all in 2440bis, or put
it all in another document.

David