Subject: [lamps] draft-ietf-lamps-cms-shakes-07

From: Russ Housley <[email-masked]>
Date: Thu, 28 Feb 2019 17:10:26 -0500

I was just looking at this document, and an inconsistency jumped out at me.

Section 4.1 says that id-shake128-len and id-shake256-len have no parameters.

However, as used in RFC 8419 has a parameter:

      hashAlg-SHAKE256-LEN  ALGORITHM  ::=  { OID id-shake256-len
                              PARMS ShakeOutputLen }

      id-shake256-len  OBJECT IDENTIFIER  ::=  { hashAlgs 18 }

      ShakeOutputLen  ::=  INTEGER  -- Output length in bits

On the other hand, id-shake256 has no parameters:

      hashAlg-SHAKE256  ALGORITHM  ::=  { OID id-shake256 }

      id-shake256  OBJECT IDENTIFIER  ::=  { hashAlgs 12 }

I think this needs to get sorted out before draft-ietf-lamps-cms-shakes goes to IETF Last Call.

Russ

---

From: Jeffrey Walton <[email-masked]>
Date: Thu, 28 Feb 2019 17:37:36 -0500

>From the algorithmic point of view, SHAKE digests can be truncated in
the traditional way. The truncated digest does not affect the output
of the hash. That is, a smaller digest size produces a prefix of a
longer one.

cSHAKE is different. The digest size affects the calculation of the
digest. Different digest sizes will produce different hashes, and the
prefix behavior does not hold.

The one area of confusion I have observed is, what is the default
output size of SHAKE-128 or SHAKE-256. For example, for SHAKE-128,
some libraries use 16, and some use 32 as the default digest size.

The SHAKE digest size is probably not needed as long as the digest
size is unambiguously stated for interop purposes.

Jeff

---

From: "Panos Kampanakis (pkampana)" <[email-masked]>
Date: Fri, 1 Mar 2019 04:19:50 +0000

Hi Russ,

Good catch. Coincidentally we just caught this yesterday. id-shake128-len and id-shake256-len were replaced with id-sha128 with 32 bytes output length and id-shake256 with 64 bytes output length. We didn't need the -len OIDs that include parameters any more. It was left in there from previous versions. 

We also fixed a discrepancy between section 3 and 4.4 about the KMAC OIDs that have parameters as optional. 

These two changes are reflected here https://github.com/csosto-pk/adding-shake-to-pkix/commit/d34de0a3903429101bb8e93f4456551c4fb8fc96 

We will push the next iteration by the end of next week. 

Panos

-----Original Message-----
From: Spasm <[email-masked]> On Behalf Of Russ Housley
Sent: Thursday, February 28, 2019 5:10 PM
To: SPASM <[email-masked]>
Subject: [lamps] draft-ietf-lamps-cms-shakes-07

Russ

_______________________________________________
Spasm mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/spasm