Subject: [IPsec] Secdir last call review of draft-ietf-ipsecme-qr-ikev2-09

From: Watson Ladd via Datatracker <[email-masked]>
Date: Tue, 24 Dec 2019 20:01:50 -0800

Reviewer: Watson Ladd
Review result: Not Ready

Twas the night before Christmas
when all through the house
someone was desperately trying to get a review done on time.

I didn't see anything wrong per se in the draft itself, but I found the
capitalization of quantum computer an odd choice. IKEv2 is a complicated
protocol, and I am not 100% sure that this draft does what we want it to: It
would be great if someone could check very carefully in some symbolic model,
ala what has been done in TLS. The guidance on sizes seems to rule out NIST
level 1, but not any higher levels: might be worth calling out this explicitly.

---

From: Watson Ladd <[email-masked]>
Date: Tue, 24 Dec 2019 20:33:57 -0800

Damn misclick. I meant With Nits.

On Tue, Dec 24, 2019 at 8:02 PM Watson Ladd via Datatracker <
[email-masked]> wrote:

> _______________________________________________
> secdir mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/secdir
> wiki: http://tools.ietf.org/area/sec/trac/wiki/SecDirReview
>

-- 
"Man is born free, but everywhere he is in chains".
--Rousseau.

---

From: Valery Smyslov <[email-masked]>
Date: Wed, 25 Dec 2019 09:52:26 +0300

Hi Watson,

thank you for spending your time on this review in Christmas Eve.

The capitalization issue has been already noticed and fixed.

I’m not sure the draft should mention NIST levels, because 

they are relevant mostly for US customers. I think that 

generic recommendations on key sizes are more appropriate

for this document.

Regards,

Valery.

On Tue, Dec 24, 2019 at 8:02 PM Watson Ladd via Datatracker <[email-masked]> wrote:

Reviewer: Watson Ladd
Review result: Not Ready

--

---

From: Uri Blumenthal <[email-masked]>
Date: Wed, 25 Dec 2019 11:57:32 +0000

NIST standards are mandatory for a subset of US citizens. But enough of businesses outside the US pay attention to what NIST says to make adding the reference relevant and useful.

> On Dec 25, 2019, at 01:52, Valery Smyslov <[email-masked]> wrote:
> 
> 
> Hi Watson,
>

---

From: Watson Ladd <[email-masked]>
Date: Wed, 25 Dec 2019 09:18:44 -0800

On Wed, Dec 25, 2019 at 3:57 AM Uri Blumenthal <[email-masked]> wrote:

> NIST standards are mandatory for a subset of US citizens. But enough of
> businesses outside the US pay attention to what NIST says to make adding
> the reference relevant and useful.
>

It's not about standards, it's about the competition and the relevant
security level definitions. Not that I feel strongly about it, just a
suggestion.

---

From: "Valery Smyslov" <[email-masked]>
Date: Wed, 25 Dec 2019 20:29:04 +0300

On Wed, Dec 25, 2019 at 3:57 AM Uri Blumenthal < <mailto:[email-masked]> [email-masked]> wrote:

It's not about standards, it's about the competition and the relevant security level definitions. Not that I feel strongly about it, just a suggestion..

          Then I'm a bit confused. What competition do you mean? 

          Regards,

          Valery.

Hi Watson,

for this document.

Regards,

Valery.

Reviewer: Watson Ladd
Review result: Not Ready

-- 

-- 

--Rousseau..

---

From: Uri Blumenthal <[email-masked]>
Date: Wed, 25 Dec 2019 18:24:38 +0000

NIST produces standards and recommendations. US government organizations and companies doing business with them are usually required to comply. Organizations and businesses (both US and non-US) that are not bound by US regulations, often pay attention to what NIST recommends. 

To repeat myself, it mages sense to add reference to the NIST levels, even if Watson doesn't insist. ;-)

> On Dec 25, 2019, at 12:29, Valery Smyslov <[email-masked]> wrote:
> 
>

---

From: Watson Ladd <[email-masked]>
Date: Wed, 25 Dec 2019 10:27:29 -0800

I'm talking about the ongoing NIST quantum cryptography competition, which
targets at the lowest level security equivalent to AES-128.

On Wed, Dec 25, 2019 at 10:24 AM Uri Blumenthal <[email-masked]> wrote:

> NIST produces standards and recommendations. US government organizations
> and companies doing business with them are usually required to comply.
> Organizations and businesses (both US and non-US) that are not bound by US
> regulations, often pay attention to what NIST recommends.
>
> suggestion..

---

From: Valery Smyslov <[email-masked]>
Date: Wed, 25 Dec 2019 21:44:05 +0300

Do you mean the post-quantum cryptography competition (https://csrc.nist.gov/Projects/post-quantum-cryptography)? 

That's why I felt confused. The draft isn't concerned with any post-quantum cryptography stuff,

it uses only well-studied methods of classical cryptography. I don't think this particular 

competition is relevant here.

However, taking into consideration Grover's algorithm, it seems that 128 bit level is the maximum

available for the current off-the-shelf crypto algorithms (I'm not aware of any widely used cipher with key 

length more than 256 bit).

Regards,

Valery.

I'm talking about the ongoing NIST quantum cryptography competition, which targets at the lowest level security equivalent to AES-128.

          Regards,

          Valery.

Hi Watson,

for this document.

Regards,

Valery.

Reviewer: Watson Ladd
Review result: Not Ready

-- 

-- 

--

---

From: Valery Smyslov <[email-masked]>
Date: Wed, 25 Dec 2019 21:45:19 +0300

Uri, I don't mind referencing NIST levels, but I'd like to first hear from my co-authors,

who are definitely more experienced in cryptography and in NIST levels than I am :-)

          Regards,

          Valery.

Hi Watson,

for this document.

Regards,

Valery.

Reviewer: Watson Ladd
Review result: Not Ready

-- 

--

---

From: Paul Wouters <[email-masked]>
Date: Thu, 26 Dec 2019 12:57:55 -0500 (EST)

> who are definitely more experienced in cryptography and in NIST levels than I am :-)

I don't think mentioning the NIST competition is useful. Per definition,
that is incomplete preliminary data.

Paul

---

From: "Panos Kampanakis (pkampana)" <[email-masked]>
Date: Fri, 27 Dec 2019 04:13:22 +0000

To make sure we mention the NIST PQ Level categorization (that will not
change as the NIST PQ Project progresses), I was thinking we could add
something in the Sec Considerations section like 

   [...] Because of
   this, the user SHOULD ensure that the post-quantum preshared key used
   has at least 256 bits of entropy, in order to provide 128 bits of
   post-quantum security.  That provides security equivalent to Level 5
   defined in the NIST PQ Project Call For Proposals [NISTPQCFP]. 

-----Original Message-----
From: IPsec <[email-masked]> On Behalf Of Paul Wouters
Sent: Thursday, December 26, 2019 12:58 PM
To: Valery Smyslov <[email-masked]>
Cc: [email-masked] WG <[email-masked]>; [email-masked];
[email-masked]; 'secdir' <[email-masked]>
Subject: Re: [IPsec] [Last-Call] [secdir] Secdir last call review of
draft-ietf-ipsecme-qr-ikev2-09

Paul

_______________________________________________
IPsec mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/ipsec

---

From: S Moonesamy <[email-masked]>
Date: Fri, 27 Dec 2019 13:54:32 -0800

Hi Ran,
At 11:16 AM 26-12-2019, R. Atkinson wrote:
>In my experience, many countries other than the US also reference 
>and use/follow many NIST specifications and many NIST recommendations/guidance.

Which countries, other than the U.S., reference many NIST specifications?

Regards,
S. Moonesamy