Subject: [lamps] I-D Action: draft-ietf-lamps-cms-hash-sig-04.txt

From: [email-masked]
Date: Tue, 12 Feb 2019 12:48:42 -0800

A New Internet-Draft is available from the on-line Internet-Drafts directories.
This draft is a work item of the Limited Additional Mechanisms for PKIX and SMIME WG of the IETF.

        Title           : Use of the HSS/LMS Hash-based Signature Algorithm in the Cryptographic Message Syntax (CMS)
        Author          : Russ Housley
	Filename        : draft-ietf-lamps-cms-hash-sig-04.txt
	Pages           : 16
	Date            : 2019-02-12

Abstract:
   This document specifies the conventions for using the the HSS/LMS
   hash-based signature algorithm with the Cryptographic Message Syntax
   (CMS).  In addition, the algorithm identifier and public key syntax
   are provided.  The HSS/LMS algorithm is one form of hash-based
   digital signature; it is described in [HASHSIG].

The IETF datatracker status page for this draft is:
https://datatracker.ietf.org/doc/draft-ietf-lamps-cms-hash-sig/

There are also htmlized versions available at:
https://tools.ietf.org/html/draft-ietf-lamps-cms-hash-sig-04
https://datatracker.ietf.org/doc/html/draft-ietf-lamps-cms-hash-sig-04

A diff from the previous version is available at:
https://www.ietf.org/rfcdiff?url2=draft-ietf-lamps-cms-hash-sig-04

Please note that it may take a couple of minutes from the time of submission
until the htmlized version and diff are available at tools.ietf.org.

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/

---

From: Russ Housley <[email-masked]>
Date: Tue, 12 Feb 2019 15:57:59 -0500

I believe that this addresses all of the WG Last Call comments that I have received.  The WG Last Call ends on Thursday, so I wanted to get the update out for people to see how their comments were addressed.

Russ

> On Feb 12, 2019, at 3:48 PM, [email-masked] wrote:
> 
>

---

From: Jim Schaad <[email-masked]>
Date: Thu, 14 Feb 2019 20:38:20 -0800

Russ,

I went through my comments and I believe that there has not yet been an
adequate response to the following issues:

> > 10.  Section 5 - I am unclear on what the text about having a random 
> > string as part of the hash computation means.  This does not appear 
> > to have anything to do with the actual value of digestAlgorithms so 
> > clarity about what is being said and why it is of importance would 
> > be nice
> 
> See Section 4.5 in [HASHSIG].  Step 4 says:
> 
>      4. set C to a uniformly random n-byte string
> 
> And then, it gets passed along in the signature value itself:
> 
>       6. return u32str(type) || C || y[0] || ... || y[p-1]
> 

Right, so this would seem to be something that can be said in the security
considerations about the strength of the hash function, but is nothing like
the seeded hash functions of RFC 6210 where a random number was generated as
carried in the parameters area of the hash function.  

[JLS] It looks like you might have trimmed this thinking that we were in
agreement, but I don't think that is true.

> > 8.  Section 3 - As I am sure I have said before, I would really like 
> > to see an id-alg-hss-lms-hashsig-direct version that omits the extra 
> > hash operation.
> 
> As I have said before, the processing in RFC 5652 assumes that a 
> signature
is
> applied to a message digest.  How would you describe the processing in
this
> document?

[JLS] There is another message out from you to ask for input on this and
while I agree there has been no direct response, I think that the message
from Scott Fluhrer is in support of my position.

Jim

> -----Original Message-----
> From: Spasm <[email-masked]> On Behalf Of Russ Housley
> Sent: Tuesday, February 12, 2019 12:58 PM
> To: [email-masked]
> Subject: Re: [lamps] I-D Action: draft-ietf-lamps-cms-hash-sig-04.txt
> 
> I believe that this addresses all of the WG Last Call comments that I have
> received.  The WG Last Call ends on Thursday, so I wanted to get the
update
> out for people to see how their comments were addressed.
> 
> Russ
> 
> 
> > This draft is a work item of the Limited Additional Mechanisms for PKIX
and
> SMIME WG of the IETF.
> >
> >        Title           : Use of the HSS/LMS Hash-based Signature
Algorithm in the
> Cryptographic Message Syntax (CMS)
> >        Author          : Russ Housley
> > Please note that it may take a couple of minutes from the time of
> > submission until the htmlized version and diff are available at
tools.ietf.org.
> _______________________________________________
> Spasm mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/spasm