Subject: Re: [Crypto-panel] Request to review: draft-selander-ace-cose-ecdhe-11

From: "Stanislav V. Smyshlyaev" <[email-masked]>
Date: Fri, 1 Mar 2019 23:32:03 +0300

Dear colleagues,

My review of the EDHOC draft (-12) has been sent to the CFRG mailing list.

Best regards,
Stanislav Smyshlyaev

пт, 22 февр. 2019 г. в 10:58, Stanislav V. Smyshlyaev <[email-masked]>:

> Dear colleagues!
>
> I’ll do it too.
>
> The deadline (March, 4th) is rather tight, but I’ll try my best to provide
> my review until that date.
>
> Best regards,
> Stanislav
>
>
> чт, 21 февр. 2019 г. в 19:54, Russ Housley <[email-masked]>:
>
>> Yes, I can take a look at it next week.
>>
>> Russ
>>
>>
>> On Feb 21, 2019, at 9:05 AM, Alexey Melnikov <[email-masked]>
>> wrote:
>>
>> Dear Crypto Panel members,
>>
>> CFRG chairs received a request to review this document (maybe even 2
>> reviews), ideally by March 4. (If you miss the deadline, a review that is
>> completed later is still useful.) Any takers?
>>
>> In particular, the review should concentrate on the following aspects of
>> the proposal:
>>
>> EDHOC (https://datatracker.ietf.org/doc/draft-selander-ace-cose-ecdhe-11)
>> is being proposed as a new AKE to meet the need of constrained/IoT
>> environments (such as those considered by the ACE WG). Formal analysis on
>> -08 was conducted by [1] [2]. A review by the Crypto Review Panel would be
>> helpful to evaluate the security properties (mutual authentication, PFS,
>> and identity protection) claimed by the draft:
>>
>> ** Top-line: does EDHOC provide the security properties it asserts?  How do we reason about/approach answering  that question?
>> ** Is this draft complete -- what would you like to see that isn't written?
>> ** What areas of the draft or features of the protocol require further analysis or polish?  Are the prerequisite/assumptions clear enough?
>> ** Are the choice of ciphersuites acceptable?
>> ** Does the formal analysis in [1] appear credible?
>> ** Does -11 appear to have addressed the concerned outlined by [1] in -08? (The authors of [1] are working on an update of the analysis on -11)
>>
>> A related key question being discussed is "ignoring whether the security properties of EDHOC are valid, can the 'lightweight property of EDHOC' be realized with another protocol"
>>
>> [1] https://link.springer.com/content/pdf/10.1007%2F978-3-030-04762-7_2.pdf
>> [2] https://github.com/theisgroenbech/edhoc-proverif
>>
>> Thank you,
>> Alexey
>>
>> _______________________________________________
>> Crypto-panel mailing list
>> [email-masked]
>> https://www.irtf.org/mailman/listinfo/crypto-panel
>>
>>
>> _______________________________________________
>> Crypto-panel mailing list
>> [email-masked]
>> https://www.irtf.org/mailman/listinfo/crypto-panel
>>
>