Subject: [Ietf-krb-wg] Camellia-CTS for Kerberos

From: Satoru Kanno <[email-masked]>
Date: Thu, 18 Feb 2010 20:45:49 +0900

Dear Kerberos-WG,

This draft is a collaborative effort between NTT and the MIT-KC
to address the use of Kerberos with the Camellia cipher using CTS mode.
A forthcoming separate draft will address the use of Camellia in GCM mode.

We request a time-slot for presenting this work at the coming IETF-77 in
March 2010.

This draft appears with the following URL.
 URL: http://www.ietf.org/id/draft-krb-wg-kanno-camellia-00.txt

Best regards,

-- 
Satoru Kanno

Security Business Unit
Mobile and Security Solution Business Group
NTT Software Corporation

e-mail: [email-masked]

_______________________________________________
ietf-krb-wg mailing list
[email-masked]
https://lists.anl.gov/mailman/listinfo/ietf-krb-wg

---

From: Simon Josefsson <[email-masked]>
Date: Thu, 18 Feb 2010 14:12:06 +0100

> A forthcoming separate draft will address the use of Camellia in GCM mode.

Interesting!  May I remind you to file proper patent disclosures on
this?  I find nothing for:

https://datatracker.ietf.org/ipr/search/?option=document_search&id_document_tag=19648

I recall earlier patent disclosures to the IETF about Camellia, but the
IETF search engine doesn't appear to find them now (perhaps they have
been removed...).  In any way, information about the patent appears to
be wildly known:

http://en.wikipedia.org/wiki/Camellia_%28cipher%29#Patent_status

/Simon

---

From: Satoru Kanno <[email-masked]>
Date: Fri, 19 Feb 2010 19:58:54 +0900

Dear Simon,

Thanks for your email.

> http://en.wikipedia.org/wiki/Camellia_%28cipher%29#Patent_status

Camellia's IPR is shown as a following URL.
Of course, this IPR is applied to Kerberos.

http://www.ietf.org/ietf/IPR/mitsubishi-ntt-joint-ipr-disclosure.pdf

As additional information, we have prepared web page about the Patent of 
NTT Crypto algorithm (e.g., Camellia, PSEC-KEM, and ESIGN etc.)

If you were interested in NTT's crypto algorithms, please check 
following URL:

http://info.isl.ntt.co.jp/crypt/eng/info/chiteki.html

Best regards,

-- 
Satoru Kanno

Security Business Unit

---

From: Simon Josefsson <[email-masked]>
Date: Fri, 19 Feb 2010 13:39:30 +0100

> http://www.ietf.org/ietf/IPR/mitsubishi-ntt-joint-ipr-disclosure.pdf

That grants rights for using Camellia with "IP sec" only.  I believe you
need to prepare a similar statement that says Kerberos instead,
alternatively (and preferably) grant rights to Camellia for any use.

/Simon

---

From: Love Hörnquist Åstrand <[email-masked]>
Date: Sat, 20 Feb 2010 20:19:26 -0800

Satoru,

   To generate an encryption key from a pass phrase and salt string, the
   Camellia uses the PBKDF2 function from PKCS #5 v2.0 [RFC2898].  This
   function of Camellia can define as same specification of AES
   [RFC3962]

   The pseudorandom function used by PBKDF2 will be a SHA-1 HMAC of the
   passphrase and salt.  The case of AES described in Appendix B of
   [RFC3962].  For pseudorandom function, Camellia can use like an AES.

The second sentence is not very clear, and can partly be dropped.

I assume you are using PBKDF2-HMAC-SHA1, using the same way as used in AES.

The pseudeo-random function (PRF) is the same as AES, except that camelia is used instead of AES.

I'm not going to worry about that AES and camellia uses the the same key, maybe its a feature ?

Love

---

From: Satoru Kanno <[email-masked]>
Date: Mon, 22 Feb 2010 14:01:22 +0900

Dear Simon,

Thank you for your comment.

(2010/02/19 21:39), Simon Josefsson wrote:
> Satoru Kanno<[email-masked]>  writes:
>
>> Dear Simon,
>>
>> Thanks for your email.
>>

Now, we are preparing Camellia IPR for Kerberos. This IPR style is 
similar to the letter of IPsec.

Best regards,
Satoru

-- 
Satoru Kanno

Security Business Unit

---

From: "Thomas Hardjono" <[email-masked]>
Date: Wed, 24 Feb 2010 11:39:03 -0500

Aside from the technical comments from Love
and the IP-related questions from Simon, we have not received
any more comments about this draft.

Initially we were going to prepare some slides
to present to the WG at IETF77.  However, since the
WG generally tries to avoid "presentations" (I am told),
we'll therefore just be ready to answer questions.

PS. Since this draft is not as yet a WG work-item,
the name of the draft will be changed to an individual
submission.

/thomas/

> -----Original Message-----
> From: [email-masked] [mailto:ietf-krb-wg-
> [email-masked]] On Behalf Of Satoru Kanno
> Sent: Monday, February 22, 2010 12:01 AM
> To: Simon Josefsson
> Cc: [email-masked]; [email-masked]
> Subject: Re: [Ietf-krb-wg] Camellia-CTS for Kerberos
> 
> Dear Simon,
> 
https://datatracker.ietf.org/ipr/search/?option=document_search&id_document_
t
> ag=19648

---

From: Luke Howard <[email-masked]>
Date: Wed, 24 Feb 2010 16:41:02 +0000

Would it better to use a more modern hash function? I appreciate the desire to not diverge too much from AES CTS but this isn't a major change.

-- Luke

--
www.padl.com | www.fghr.net

---

From: Thomas Hardjono <[email-masked]>
Date: Wed, 24 Feb 2010 11:47:47 -0500

Hi Luke,

Any specific modern hash functions in mind?

Thanks.

/thomas/

> [email-masked]] On Behalf Of Luke Howard
> Sent: Wednesday, February 24, 2010 11:41 AM
> To: Thomas Hardjono
> Cc: [email-masked]
> Would it better to use a more modern hash function? I appreciate the desire
> to not diverge too much from AES CTS but this isn't a major change.
> 
> -- Luke
>

---

From: Luke Howard <[email-masked]>
Date: Wed, 24 Feb 2010 16:49:25 +0000

I'm no cryptography expert, of course. I was simply thinking of SHA-2.

-- Luke

---

From: Thomas Hardjono <[email-masked]>
Date: Wed, 24 Feb 2010 11:52:01 -0500

Oh ok, thanks :) 
Is the WG ok with that?

/thomas/

> From: Luke Howard [mailto:[email-masked]]
> Sent: Wednesday, February 24, 2010 11:49 AM
> To: Thomas Hardjono