Subject: [ietf-tls] I-D ACTION:draft-ietf-tls-misty1-00.txt

From: [email-masked]
Date: Tue, 03 Oct 2000 06:49:57 -0400

A New Internet-Draft is available from the on-line Internet-Drafts directories.
This draft is a work item of the Transport Layer Security Working Group of the IETF.

	Title		: Addition of MISTY1 to TLS
	Author(s)	: H. Ohta, H. Tsuji
	Filename	: draft-ietf-tls-misty1-00.txt
	Pages		: 3
	Date		: 02-Oct-00
	
This document proposes the addition of new cipher suites to the TLS
protocol version 1.0 to support the MISTY1 encryption algorithm as a
bulk cipher algorithm.

A URL for this Internet-Draft is:
http://www.ietf.org/internet-drafts/draft-ietf-tls-misty1-00.txt

Internet-Drafts are also available by anonymous FTP. Login with the username
"anonymous" and a password of your e-mail address. After logging in,
type "cd internet-drafts" and then
	"get draft-ietf-tls-misty1-00.txt".

A list of Internet-Drafts directories can be found in
http://www.ietf.org/shadow.html 
or ftp://ftp.ietf.org/ietf/1shadow-sites.txt

Internet-Drafts can also be obtained by e-mail.

Send a message to:
	[email-masked].
In the body type:
	"FILE /internet-drafts/draft-ietf-tls-misty1-00.txt".
	
NOTE:	The mail server at ietf.org can return the document in
	MIME-encoded form by using the "mpack" utility.  To use this
	feature, insert the command "ENCODING mime" before the "FILE"
	command.  To decode the response(s), you will need "munpack" or
	a MIME-compliant mail reader.  Different MIME-compliant mail readers
	exhibit different behavior, especially when dealing with
	"multipart" MIME messages (i.e. documents which have been split
	up into multiple messages), so check your local documentation on
	how to manipulate these messages.

Below is the data which will enable a MIME compliant mail reader
implementation to automatically retrieve the ASCII version of the
Internet-Draft.
---
You are currently subscribed to ietf-tls as: [email-masked]
To unsubscribe send a blank email to [email-masked]

---

From: Paul Hoffman / IMC <[email-masked]>
Date: Tue, 3 Oct 2000 14:35:30 -0700

Do we *really* want to waste time discussing a patent-encumbered 
algorithm in this WG? Why is this a WG work item?

Although draft-ietf-tls-misty1-00.txt fails to mention any patent 
application, it points to the algorithm spec, 
draft-ohta-misty1desc-02.txt, which states:

5. Legal Issues

    The algorithm description is applied for a patent in several
    countries as PCT/JP96/02154.  However, the algorithm is freely
    available for academic (non-profit) use.  Additionally, the algorithm
    can be used for commercial use without paying the patent fee if you
    contract with Mitsubishi Electric Corporation.  For more information,
    please contact at [email-masked].

What is the point of discussing this in the WG?

--Paul Hoffman, Director
--Internet Mail Consortium

---

---

From: Ben Laurie <[email-masked]>
Date: Tue, 03 Oct 2000 22:41:57 +0100

Paul Hoffman / IMC wrote:
> application,

Which is in violation of the guidelines.

> it points to the algorithm spec,

Its not exactly an onerous requirement, is it? An email saying "Hi" to
[email-masked] would appear to satisfy.

Cheers,

Ben.

--
http://www.apache-ssl.org/ben.html

Coming to ApacheCon Europe 2000? http://apachecon.com/

---

---

From: Eric Rescorla <[email-masked]>
Date: 03 Oct 2000 14:48:11 -0700

> [email-masked] would appear to satisfy.
That's not obvious. You need to contact them for more information.
It doesn't say what that information will be.

Maybe you have to give them a DNA sample or your firstborn whild
or something. That wouldn't be a "fee", strictly speaking.

-Ekr

---

---

From: Ben Laurie <[email-masked]>
Date: Tue, 03 Oct 2000 22:47:00 +0100

> It doesn't say what that information will be.

Sorry, misread it - I thought "contract with Mitsubishi" said "contact
with Mitsubishi".

Doh!

I now agree with the original point.

Cheers,

Ben.

---

---

From: David Hopwood <[email-masked]>
Date: Tue, 03 Oct 2000 21:39:33 +0100

-----BEGIN PGP SIGNED MESSAGE-----

> protocol version 1.0 to support the MISTY1 encryption algorithm as a

What benefit does MISTY1 provide that is not provided by, say, AES?

- From <http://www.mitsubishi.com/ghp_japan/misty/250perf.htm>:
# MISTY1 with eight rounds encrypts a data stream at a speed of 20Mbps
# on an Intel Pentium 100MHz computer and 40Mbps on an HP PA7200 120MHz,
# respectively.

Note that this is significantly slower than 14-round Rijndael (i.e.
256-bit AES):

- From <http://www.tml.hut.fi/~helger/aes/table.html>:
  320 clocks/block for 10-round Rijndael =>
      10/14 * 100*128/320 = 28.6 Mbps for 14 rounds on a P100.

There are no figures for a PA7200, but
  186 clocks/block for 10-round Rijndael =>
      10/14 * 120*128/186 = 59.0 Mbps for 14 rounds on a PA8200,
                            normalised to 120 Mhz.

(actually I'm not sure a PA8200 goes as low as 120 MHz, but you get
the point).

The hardware performance/size tradeoff is also worse than 14-round
Rijndael, and I don't see any reason to believe that MISTY1 is more
secure. In fact it has had a lot less analysis than Rijndael has (and
certainly less than it will get as AES). Without that analysis, the
'proven' security properties should be treated with some skepticism;
designs with similar proofs have been broken in the past.

I'm not sure what the patent status is, either. If it was to be accepted,
a IP statement from Mitsubishi would be required.

- -- 
David Hopwood <[email-masked]>

Home page & PGP public key: http://www.users.zetnet.co.uk/hopwood/
RSA 2048-bit; fingerprint 71 8E A6 23 0E D3 4C E5  0F 69 8C D4 FA 66 15 01
Nothing in this message is intended to be legally binding. If I revoke a
public key but refuse to specify why, it is because the private key has been
seized under the Regulation of Investigatory Powers Act; see www.fipr.org/rip

---

---

From: David Hopwood <[email-masked]>
Date: Tue, 03 Oct 2000 21:56:00 +0100

-----BEGIN PGP SIGNED MESSAGE-----

> Which is in violation of the guidelines.

Indeed.

> [email-masked] would appear to satisfy.

It might satisfy if-and-only-if Mitsubishi guaranteed that there would
continue to be a royalty-free license permanently. However, as I pointed
out in my other post, MISTY1 doesn't really have any advantages over AES.

- -- 

---

---

From: Eric Rescorla <[email-masked]>
Date: 03 Oct 2000 16:27:11 -0700

> out in my other post, MISTY1 doesn't really have any advantages over AES.
I think this is the key issue here. If MISTY1 is a good idea then
surely Twofish, CAST, etc. are even better ideas since they're
strong fast, and royalty free. On the other hand, if there's
not enough reason to standardize these algorithms, why would we
even consider MISTY1?

-Ekr

---

---

From: Win Treese <[email-masked]>
Date: Wed, 04 Oct 2000 09:53:17 -0400

I don't expect to put MISTY1 ciphersuites forward on the standards
track. Are there substantive comments on the draft, or objections to it
becoming an Informational RFC?

	 - Win Treese

---

---

From: Preda Mihailescu <[email-masked]>
Date: Wed, 04 Oct 2000 17:09:29 +0200

Win Treese wrote:

> You are currently subscribed to ietf-tls as: [email-masked]

---

---

From: David Hopwood <[email-masked]>
Date: Wed, 04 Oct 2000 19:46:39 +0100

-----BEGIN PGP SIGNED MESSAGE-----

> becoming an Informational RFC?

Yes, there are objections to it becoming an informational RFC:

 - the current draft does not conform to section 10 of RFC 2026, because
   MISTY1 is patented and the draft doesn't mention that.

 - MISTY1 has no apparent advantages over AES, and an unnecessary
   proliferation of ciphersuites is undesirable, even if they are only
   defined in informational RFCs.

 - new DH_anon ciphersuites should not be added.

The same objections apply to the Camellia draft (with the additional
objection that it defines 18 ciphersuites for a single cipher, which is
arguably excessive).

- -- 

---

---

From: "David P. Kemp" <[email-masked]>
Date: Thu, 5 Oct 2000 08:46:24 -0400 (EDT)

I believe anyone has the right to submit an Informational RFC and
request IANA registration for non-general-purpose algorithms.

I do agree with David, Paul, and Eric that the TLS working group should
have no sponsorship of these drafts/RFCs.  They should be purely individual
submissions.

Dave

> Date: Wed, 04 Oct 2000 19:46:39 +0100
> From: David Hopwood <[email-masked]>
> To: "IETF Transport Layer Security WG" <[email-masked]>
> Subject: [ietf-tls] Re: I-D ACTION:draft-ietf-tls-misty1-00.txt
> 
> Win Treese wrote:

---

---

From: Hirosato Tsuji <[email-masked]>
Date: Mon, 16 Oct 2000 15:30:12 +0900

Dear TLS-WG members, 

> becoming an Informational RFC?

  We are very sorry to be late in responding your comments. 

  As our previous draft didn't mention an enough statement 
  on IPR of MISTY1, there might be misunderstandings. So 
  please let me introduce the current IPR of MISTY1 to you. 

>    MISTY1 is patented and the draft doesn't mention that.

  Agreed. We will add the IPR statement of MISTY1 to the next draft. 

> Sorry, misread it - I thought "contract with Mitsubishi" said "contact

  We are sorry that currently email saying "Hi" from you isn't enough 
  to give you the royalty-free patent license. We need the "MISTY Patent 
  Roalty-Free License Agreement" from you. This rule was decided to 
  consider the Japanese goverment's export control law. Please understand 
  that it is NOT intended to restrict your implementation and application 
  of MISTY. 

  The followings are the extracts from the IPR statement on Mitsubishi 
  Electric's home page. 

    - Conditions for the royalty-free patent license
        - Only entites who complete the "MISTY Patent Roalty-Free License 
          Agreement" may reserve a copy of the royalty free license.
        - MISTY1 Patent Royalty-Free License Agreement English version (sample)

    - Information on the MISTY1 Patent Royalty-Free License Agreement
        Mitsubishi Electric Corporation Corporate　Licensing　Dept. (Group 1)
        FAX: +81-3-5252-7879 

  You can find the complete IPR statement at the following URL. 

    http://www.mitsubishi.com/ghp_japan/misty/licensee.htm

> or something. That wouldn't be a "fee", strictly speaking.

  Sorry for our ambiguous statements. But We promise that we don't 
  require your DNA samples nor your firstborn children. 

> out in my other post, MISTY1 doesn't really have any advantages over AES.

  We believe that Mitsubishi Electric will continue the royalty-free patent 
  license permanetly. But our current IPR statement doesn't mention about 
  that issue explicitly. Do we need the explicit statement to guarantee? 

  We proposed the cipher suites with "MISTY1" not only for our internal 
  use nor private use. We hope that you can implement TLS with "MISTY1" 
  and use them worldwide freely. 

  If you have more comments and suggestions to improve our internet draft, 
  please let us know. Thank you for your cooperation. 

--------------------------------------------------
  Hirosato Tsuji  <[email-masked]>
  Mitsubishi Electric Corporation
  Information Technology R&D Center
  5-1-1 Ofuna, Kamakura, Kanagawa 247-8501 JAPAN
--------------------------------------------------

---

---

From: Paul Hoffman / IMC <[email-masked]>
Date: Mon, 16 Oct 2000 09:47:19 -0700

>   Agreed. We will add the IPR statement of MISTY1 to the next draft.

That is not what RFC 2026 says. Please read RFC 2026 and then follow 
it. Otherwise, you will be wasting your time and our time. This 
extended discussion on how to handle IPR for what should be an 
Informational RFC is kind of a waste of the technical resources on 
this mailing list.

--Paul Hoffman, Director

---