Subject: [lamps] AD Review: draft-ietf-lamps-cms-mix-with-psk-05

From: Roman Danyliw <[email-masked]>
Date: Tue, 16 Jul 2019 20:07:51 +0000

Hi!

The following is my AD review of draft-ietf-lamps-cms-mix-with-psk-05.  Given the substance of these comments, it can be handled with IETF LC comments.

(1) Section 9.  The object identifier is called "id-mod-cms-ori-psk-2017" in the IANA section (Section 9) but "id-mod-cms-ori-psk-2019" in the ASN.1 Module (Section 6).  Seems like they should be the same.

(2) Section B.1.  This section does not list the plaintext content

(3) Improved references:

** Section 1.  Is there a citation that can be provided for the obvious "The invention of a large-scale quantum computer would pose a serious challenge for the cryptographic algorithms that are widely deployed  today"?

** Section 1.  Is there a citation that can be provided for "It is an open question whether or not it is feasible to build  a large-scale quantum computer ...".  Perhaps:
[NAS2019] National Academies of Sciences, Engineering, and Medicine, "Quantum Computing: Progress and Prospects", The National Academies Press, DOI 10.17226/25196, 2019.

** Section 1.  Is there a citation that can be provided for "there are longstanding concerns about undisclosed trapdoors in Diffie-Hellman paramters"?

(4) Editorial Nits
** Section 1. Recommend weakening the statement.  s/invulnerable to an attacker/resistant to an attacker/

** Section 1.  Typo.  s/Diffie-Hellamn/Diffie-Hellman/

** Section 3 and 4.  Since Section 2 calls out that there two techniques, keyTransPSK and keyAgreePSK, should the section 3 and 4 titles be those names instead of the underlying CMS data structure names?

** Section 5.  Typo.  s/ fo / of /

** Section 5.  Typo?.  s/deines/identifies/

** Section 7.  Typo.  s/materail/material/

** Section 7.  Typo. /an purpose/a purpose/

** Section 7.  Typo.  Consistently choose either "implementers" or "implementors"

** Section 7.  I think it would be helpful to move the text on the ProVerif proof from the Acknowledgements up to the Security Considerations section

** Appendix A/B.  Multiple Typos.  s/omited/omitted/g

** Appendix A.1.  Multiple Places.  Typo.  s/resutling/resulting/g

** Appendix A.*. Mutiple Places.  Typo.  s/resutling/resulting/g

---

From: Russ Housley <[email-masked]>
Date: Wed, 17 Jul 2019 14:07:32 -0400

Roman:

Thanks for the careful review.  I will wait to see what other IETF Last Call comments come along before posting a revision.

> (1) Section 9.  The object identifier is called "id-mod-cms-ori-psk-2017" in the IANA section (Section 9) but "id-mod-cms-ori-psk-2019" in the ASN.1 Module (Section 6).  Seems like they should be t…

Good catch.  I have changes it to id-mod-cms-ori-psk-2019.

> (2) Section B.1.  This section does not list the plaintext content

It is true.  I'll add it, but it is the same as B.3.

Alice encrypts the content using AES-256-GCM with the content-
encryption key.  The 12-octet nonce used is:
   dbaddecaf888cafebabeface

The plaintext is:
   48656c6c6f2c20776f726c6421

The resulting ciphertext is:
   fc6d6f823e3ed2d209d0c6ffcf

The resulting 12-octet authentication tag is:
   550260c42e5b29719426c1ff

> ** Section 1.  Is there a citation that can be provided for the obvious "The invention of a large-scale quantum computer would pose a serious challenge for the cryptographic algorithms that are wid…

   [S1994]    Shor, P., "Algorithms for Quantum Computation: Discrete
              Logarithms and Factoring", Proceedings of the 35th Annual
              Symposium on Foundations of Computer Science, 1994, pp.
              124-134.

> [NAS2019] National Academies of Sciences, Engineering, and Medicine, "Quantum Computing: Progress and Prospects", The National Academies Press, DOI 10.17226/25196, 2019.

Yes, I'll add that reference.

> ** Section 1.  Is there a citation that can be provided for "there are longstanding concerns about undisclosed trapdoors in Diffie-Hellman paramters"?

   [FGHT2016] Fried, J., Gaudry, P., Heninger, N., and E. Thome, "A
              kilobit hidden SNFS discrete logarithm computation",
              Cryptology ePrint Archive, Report 2016/961, 2016.
              https://eprint.iacr.org/2016/961.pdf.

> ** Section 1. Recommend weakening the statement.  s/invulnerable to an attacker/resistant to an attacker/

Yes, that is better.

> ** Section 1.  Typo.  s/Diffie-Hellamn/Diffie-Hellman/

Fixed.

> ** Section 3 and 4.  Since Section 2 calls out that there two techniques, keyTransPSK and keyAgreePSK, should the section 3 and 4 titles be those names instead of the underlying CMS data structure…

Okay.  The section titles have been changed.

> ** Section 5.  Typo.  s/ fo / of /

Fixed.

> ** Section 5.  Typo?.  s/deines/identifies/

No, it should be "defines"

> ** Section 7.  Typo.  s/materail/material/

Fixed.

> ** Section 7.  Typo. /an purpose/a purpose/

Fixed.

> ** Section 7.  Typo.  Consistently choose either "implementers" or "implementors"

There were many more "implementers", so I went with that spelling.

> ** Section 7.  I think it would be helpful to move the text on the ProVerif proof from the Acknowledgements up to the Security Considerations section

Done.

> ** Appendix A/B.  Multiple Typos.  s/omited/omitted/g

Fixed.  (I found it in two places.)

> ** Appendix A.*. Mutiple Places.  Typo.  s/resutling/resulting/g

Fixed. (I found it in four places.)

Russ

---

From: Roman Danyliw <[email-masked]>
Date: Fri, 19 Jul 2019 23:47:34 +0000

Hi Russ!

Sounds good on all of the numbered items; and on waiting for all of the feedback from IETF LC to produce an update.

Thanks,
Roman

From: Russ Housley [mailto:[email-masked]]
Sent: Wednesday, July 17, 2019 2:08 PM
To: Roman Danyliw <[email-masked]>
Cc: [email-masked]
Subject: Re: [lamps] AD Review: draft-ietf-lamps-cms-mix-with-psk-05

Roman:

The plaintext is:

(3) Improved references:

(4) Editorial Nits

Yes, that is better.

Fixed.

Fixed.

Fixed.

Fixed.

Done.

Russ