Subject: [Curdle] draft-ietf-curdle-cms-chacha20-poly1305

From: Jim Schaad <[email-masked]>
Date: Sat, 10 Sep 2016 18:16:57 -0700

I would agree that the document is ready for WGLC.  That said I have some
comments.

1. The second sentence in the abstract feels like it got truncated to me.  I
feel like it should finish with something along the lines of " that provides
an Authenticated Encryption algorithm."

2.  Traditionally, these documents have a section on S/MIME capabilities and
this document does not have one.

3.  I do not know what the limit is on the Poly1305 authentication tag.
Does this affect the maximum length as presented in paragraph 3 of section
5?

s/one algorithm identifiers/one algorithm identifier/
s/likely ot be/likely to be/

jim

---

From: Russ Housley <[email-masked]>
Date: Sun, 11 Sep 2016 15:22:44 -0400

Jim:

Thanks for the review.

for the improved Abstract I propose:

   This document describes the conventions for using ChaCha20-Poly1305
   Authenticated Encryption in the Cryptographic Message Syntax (CMS).
   ChaCha20-Poly1305 is an authenticated encryption algorithm
   constructed of the ChaCha stream cipher and Poly1305 authenticator.

An object identifier needs to be assigned to add the SMimeCapabilities.  I can add a TBD, or I can wait for that assignment.

According to RFC 7539, the Poly1305 algorithm produces a 16-byte authentication tag.

Russ

---

From: Jim Schaad <[email-masked]>
Date: Sun, 11 Sep 2016 12:52:59 -0700

> -----Original Message-----
> From: Russ Housley [mailto:[email-masked]]
> Sent: Sunday, September 11, 2016 12:23 PM
> To: Jim Schaad <[email-masked]>
> Cc: [email-masked]
> Subject: Re: draft-ietf-curdle-cms-chacha20-poly1305
> 
> Jim:
> 
> Thanks for the review.
> 
> An object identifier needs to be assigned to add the SMimeCapabilities.  I
can
> add a TBD, or I can wait for that assignment.

I expect to see a section or a paragraph describing the SMIME capabilities
defined in the document.  I don't care about what the actual OID is.

> According to RFC 7539, the Poly1305 algorithm produces a 16-byte

And is or is not a limitation problem for the length of the text to be
encrypted?

Jim

> > I would agree that the document is ready for WGLC.  That said I have
> > some comments.
> >
> > 1. The second sentence in the abstract feels like it got truncated to
> > me.  I feel like it should finish with something along the lines of "
> > that provides an Authenticated Encryption algorithm."
> >
> > 2.  Traditionally, these documents have a section on S/MIME
> > capabilities and this document does not have one.
> >
> > Does this affect the maximum length as presented in paragraph 3 of
> > section 5?
> >
> > s/one algorithm identifiers/one algorithm identifier/ s/likely ot
> > be/likely to be/
> >
> >
> > jim
> >
> >

---

From: Russ Housley <[email-masked]>
Date: Sun, 11 Sep 2016 16:43:22 -0400

> defined in the document.  I don't care about what the actual OID is.

Okay.

> And is or is not a limitation problem for the length of the text to be

RFC 7539 says:

   The Poly1305 authenticator is designed to ensure that forged messages
   are rejected with a probability of 1-(n/(2^102)) for a 16n-byte
   message, even after sending 2^64 legitimate messages

So, the Poly1305 authenticator does not seem to be part of the reason for the limits in the Security Considerations.

Russ