Subject: Re: [Tls-reg-review] Request to register value in TLS bar registry

From: Yoav Nir <[email-masked]>
Date: Fri, 1 Feb 2019 20:57:27 +0200

[Adding IANA]

Hi, Stanislav

Sorry for dropping this.  Yes, we’ve considered this, and you can definitely have the registration as described in your draft.

Yoav

https://tools.ietf.org/html/draft-smyshlyaev-tls12-gost-suites-04#section-9 <https://tools.ietf.org/html/draft-smyshlyaev-tls12-gost-suites-04#section-9>

> On 1 Feb 2019, at 9:28, Смышляев Станислав Витальевич <[email-masked]> wrote:
> 
> Dear Yoav, Rich and Nick,
>  
> Do you have any additional questions about this request? Dmitry Belyavsky and I will be very happy to provide any clarifications, if needed.
>  
> Best regards,
> Stanislav Smyshlyaev, Ph.D.
> CISO, CryptoPro LLC
>  
> From: Смышляев Станислав Витальевич <[email-masked]> 
> Sent: Wednesday, January 9, 2019 11:26 PM
> To: Yoav Nir <[email-masked]>
> Cc: Евгений Алексеев <[email-masked]>; [email-masked]; Смышляева Екатерина Сергеевна <[email-masked]>; Коллегин Максим Дмитриевич <[email-masked]>; Алексеев Евгений Константинович <[email-masked]>; Белявский Дмитрий <[email-masked]>
> Subject: Re: [Tls-reg-review] Request to register value in TLS bar registry
>  
> CC’ing Dmitry Belyavsky (in case he would like to add some other clarifications), who we discussed the IANA request for the GOST cipher suites with (in Bangkok).
>  
> Best regards,
> Stanislav Smyshlyaev
> 
> 
> 9 янв. 2019 г., в 22:52, Смышляев Станислав Витальевич <[email-masked] <mailto:[email-masked]>> написал(а):
> 
> Dear Yoav, 
>  
> Thank you very much for your comments!
> If you don’t mind, I’ll reply:
> 1) Yes, Kuznyechik is the new Russian cipher. It is defined in RFC 7801. 
> 2) There’s still work in progress on an AEAD mode to be standardized in Russia - and we can’t have a TLS 1.3 cipher suite without an AEAD mode. Currently the MGM mode (see https://tools.ietf.org/html/draft-smyshlyaev-mgm-09 <https://tools.ietf.org/html/draft-smyshlyaev-mgm-09>) is being carefully studied and tends to be the one. Valery Smyslov waits for it also - to be able to work on IKEv2 and ESP with GOSTs. 
> That’s why the current request (and the draft it refers to) is only about TLS 1.2 so far. 
> 3) Unfortunately, there is a misleading statement in the current version of the draft (thank you for pointing to it, Yoav!): actually, {0x00, 0x81} is used for the older cipher suite from https://tools.ietf.org/html/draft-chudov-cryptopro-cptls-04#section-5 <https://tools.ietf.org/html/draft-chudov-cryptopro-cptls-04#section-5>. The existing implementations of TLS_GOSTR341112_256_WITH_28147_CNT_IMIT use the number {0xFF, 0x85}
>  
> Best regards,
> Stanislav Smyshlyaev 
> 
> 9 янв. 2019 г., в 21:39, Yoav Nir <[email-masked] <mailto:[email-masked]>> написал(а):
> 
> Hi, Evgeny. 
>  
> We’ll give the answer in a few days. First, I’d like to ask a few clarifying questions:
> If I understand correctly, the Kuznyechik ciphers in this document is the new GOST algorithms, right?
> I have noticed that this is only for TLS 1.2.  Why not TLS 1.3?
> Section 10 mentions that there are existing implementations that use the value {0x00,0x81} for TLS_GOSTR341112_256_WITH_28147_CNT_IMIT.  I see in the IANA registry <https://www.iana.org/assignments/tls-parameters/tls-parameters.xml#tls-parameters-4> that this value is free.  Do you want to re-use it? 
>  
> Thanks
>  
> Yoav
> 
> 
> On 9 Jan 2019, at 15:16, Евгений Алексеев <geni-cmc=[email-masked] <mailto:geni-cmc=[email-masked]>> wrote:
>  
> Hello!
> 
> We would like to ask IANA to assign numbers in accordance with the IANA Considerations section of the "GOST Cipher Suites for Transport Layer Security (TLS) Protocol Version 1.2" document (https://tools.ietf.org/html/draft-smyshlyaev-tls12-gost-suites-04#section-9 <https://tools.ietf.org/html/draft-smyshlyaev-tls12-gost-suites-04#section-9>).
> 
> -- 
> Best regards,
> Evgeny Alekseev
> _______________________________________________
> tls-reg-review mailing list
> [email-masked] <mailto:[email-masked]>
> https://www.ietf.org/mailman/listinfo/tls-reg-review <https://www.ietf.org/mailman/listinfo/tls-reg-review>

---

From: Yoav Nir <[email-masked]>
Date: Fri, 1 Feb 2019 21:50:41 +0200

Hi, Amanda.  Inline.

Authors: please check my answers, especially about the supported groups.

> On 1 Feb 2019, at 21:32, Amanda Baber via RT <[email-masked]> wrote:
> 
> Hi Yoav,
> 
> We have questions about these registrations:
> 
> 1) Do you want us to make all of the registrations in the IANA Considerations section, or is this request just referring to the TLS Cipher Suites?

[YN] - all of it

> 2) Which values are we assigning to the TLS Cipher Suites? Are we assigning {0xFF, 0x83} to TLS_GOSTR341112_256_WITH_KUZNYECHIK_CTR_OMAC, {0xFF, 0x84} to TLS_GOSTR341112_256_WITH_MAGMA_CTR_OMAC, and {0xFF, 0x85} for TLS_GOSTR341112_256_WITH_28147_CNT_IMIT ? Also, is the value of the "Recommended" column "N”?

None of these are IETF-endorsed algorithms, so the Recommended column is ’N’.  The numbers are fine, but I believe that no specific numbers were requested, so any numbers should be OK.

> 3) For the TLS SignatureAlgorithm registrations, can you confirm that we should  start from value 64, the beginning of the Specification Required range? (Also because the values are marked "Reserved" rather than "Unassigned," is it possible to make registrations here without an approved document? Is "Reserved," which in RFC 8126 means "unavailable for assignment," meant to indicate availability here, as it sometimes did for older registries?)

Yes, starting at 64 is fine.

> 4) For the TLS Supported Groups registrations, should we start from value 34, 261, 512, or 65283?

That’s a little complex.  Authors, please check that I am correct here:
GC256A (TBD6), GC512A (TBD10), GC512B (TBD11), and GC512C (TBD12) are elliptic curve, so they should start at 34.
The others (TBD7, TBD8, TBD9) are finite field, so they should start at 261.

> 5) Can you confirm that the TLS ClientCertificateType Identifiers registrations should start from 67, the first available value in the Specification Required range?

Sure.

> The registries are here:
> 
> https://www.iana.org/assignments/tls-parameters
> 
> Best regards,
> 
> Amanda Baber
> Lead IANA Services Specialist
> 
> On Fri Feb 01 18:58:12 2019, [email-masked] wrote:
>> [Adding IANA]
>> 
>> Hi, Stanislav
>> 
>> Sorry for dropping this.  Yes, we’ve considered this, and you can
>> definitely have the registration as described in your draft.
>> 
>> Yoav
>> 
>> https://tools.ietf.org/html/draft-smyshlyaev-tls12-gost-suites-
>> 04#section-9 <https://tools.ietf.org/html/draft-smyshlyaev-tls12-gost-
>> suites-04#section-9>
>> 
>> 
>>> Do you have any additional questions about this request? Dmitry
>>> Belyavsky and I will be very happy to provide any clarifications, if
>>> needed.
>>> 
>>> Best regards,
>>> Cc: Евгений Алексеев <[email-masked]>; [email-masked];
>>> Смышляева Екатерина Сергеевна <[email-masked]>; Коллегин Максим
>>> Дмитриевич <[email-masked]>; Алексеев Евгений Константинович
>>> <[email-masked]>; Белявский Дмитрий <[email-masked]>
>>> CC’ing Dmitry Belyavsky (in case he would like to add some other
>>> clarifications), who we discussed the IANA request for the GOST
>>> cipher suites with (in Bangkok).
>>> 
>>> Best regards,
>>> Stanislav Smyshlyaev
>>> 
>>> 
>>> 9 янв. 2019 г., в 22:52, Смышляев Станислав Витальевич
>>> <[email-masked] <mailto:[email-masked]>> написал(а):
>>> 
>>> Dear Yoav,
>>> 
>>> 2) There’s still work in progress on an AEAD mode to be standardized
>>> in Russia - and we can’t have a TLS 1.3 cipher suite without an AEAD
>>> mode. Currently the MGM mode (see https://tools.ietf.org/html/draft-
>>> smyshlyaev-mgm-09 <https://tools.ietf.org/html/draft-smyshlyaev-mgm-
>>> 09>) is being carefully studied and tends to be the one. Valery
>>> Smyslov waits for it also - to be able to work on IKEv2 and ESP with
>>> GOSTs.
>>> 3) Unfortunately, there is a misleading statement in the current
>>> version of the draft (thank you for pointing to it, Yoav!): actually,
>>> {0x00, 0x81} is used for the older cipher suite from
>>> https://tools.ietf.org/html/draft-chudov-cryptopro-cptls-04#section-5
>>> <https://tools.ietf.org/html/draft-chudov-cryptopro-cptls-04#section-
>>> 5>. The existing implementations of
>>> TLS_GOSTR341112_256_WITH_28147_CNT_IMIT use the number {0xFF, 0x85}
>>> 
>>> Best regards,
>>> Stanislav Smyshlyaev
>>> 
>>> 9 янв. 2019 г., в 21:39, Yoav Nir <[email-masked]
>>> <mailto:[email-masked]>> написал(а):
>>> 
>>> Hi, Evgeny.
>>> 
>>> Section 10 mentions that there are existing implementations that use
>>> the value {0x00,0x81} for TLS_GOSTR341112_256_WITH_28147_CNT_IMIT.  I
>>> see in the IANA registry <https://www.iana.org/assignments/tls-
>>> parameters/tls-parameters.xml#tls-parameters-4> that this value is
>>> free.  Do you want to re-use it?
>>> 
>>> Thanks
>>> 
>>> Yoav
>>> 
>>> 
>>> On 9 Jan 2019, at 15:16, Евгений Алексеев <geni-
>>> cmc=[email-masked] <mailto:geni-
>>> cmc=[email-masked]>> wrote:
>>> 
>>> Hello!
>>> 
>>> We would like to ask IANA to assign numbers in accordance with the
>>> IANA Considerations section of the "GOST Cipher Suites for Transport
>>> Layer Security (TLS) Protocol Version 1.2" document
>>> (https://tools.ietf.org/html/draft-smyshlyaev-tls12-gost-suites-
>>> 04#section-9 <https://tools.ietf.org/html/draft-smyshlyaev-tls12-
>>> gost-suites-04#section-9>).
>>> 
>>> --
>>> Best regards,
>>> Evgeny Alekseev
>>> https://www.ietf.org/mailman/listinfo/tls-reg-review
>>> <https://www.ietf.org/mailman/listinfo/tls-reg-review>
>

---

From: Смышляев Станислав Витальевич <[email-masked]>
Date: Fri, 1 Feb 2019 21:30:06 +0000

Dear Yoav, Dear Amanda,

Thank you very much for your prompt reply!

  *   The others (TBD7, TBD8, TBD9) are finite field, so they should start at 261.

Let me correct you a little here, if you don’t mind: these three are also elliptic curve ones (they are defined in RFC 4357 along with finite field ones, but these three are elliptic curves, unlike GOST R 34.10-94 parameters, which were finite field ones). So all TBD6-TBD12 should start at 34.

{0xFF, 0x85} for TLS_GOSTR341112_256_WITH_28147_CNT_IMIT
is perfect, but another one ({0xFF, 0x83} collides with a privately used (by someone) old SSL_RSA_WITH_3DES_EDE_CBC_MD5.

So, if possible, it would be great if you could assign the following numbers, for example:

{0xFF, 0x89} to TLS_GOSTR341112_256_WITH_KUZNYECHIK_CTR_OMAC,
{0xFF, 0x88} to TLS_GOSTR341112_256_WITH_MAGMA_CTR_OMAC,

(and
{0xFF, 0x85} for TLS_GOSTR341112_256_WITH_28147_CNT_IMIT, as you have proposed)

Of course, “N” in “Recommended” column for all of them.

Thank you very much!

Best regards,
Stanislav

1 февр. 2019 г., в 22:50, Yoav Nir <[email-masked]<mailto:[email-masked]>> написал(а):

Hi, Amanda.  Inline.

On 1 Feb 2019, at 21:32, Amanda Baber via RT <[email-masked]<mailto:[email-masked]>> wrote:

Hi Yoav,

[YN] - all of it

  *   GC256A (TBD6), GC512A (TBD10), GC512B (TBD11), and GC512C (TBD12) are elliptic curve, so they should start at 34.
  *   The others (TBD7, TBD8, TBD9) are finite field, so they should start at 261.

Sure.

The registries are here:

Best regards,

Amanda Baber

On Fri Feb 01 18:58:12 2019, [email-masked]<mailto:[email-masked]> wrote:
[Adding IANA]

Hi, Stanislav

Yoav

On 1 Feb 2019, at 9:28, Смышляев Станислав Витальевич
<[email-masked]<mailto:[email-masked]>> wrote:

Best regards,

From: Смышляев Станислав Витальевич <[email-masked]<mailto:[email-masked]>>
Sent: Wednesday, January 9, 2019 11:26 PM
To: Yoav Nir <[email-masked]<mailto:[email-masked]>>
Cc: Евгений Алексеев <[email-masked]<mailto:[email-masked]>>; [email-masked]<mailto:[email-masked]>;
Смышляева Екатерина Сергеевна <[email-masked]<mailto:[email-masked]>>; Коллегин Максим
Дмитриевич <[email-masked]<mailto:[email-masked]>>; Алексеев Евгений Константинович
<[email-masked]<mailto:[email-masked]>>; Белявский Дмитрий <[email-masked]<mailto:[email-masked]>>
Subject: Re: [Tls-reg-review] Request to register value in TLS bar
registry

Best regards,
Stanislav Smyshlyaev

9 янв. 2019 г., в 22:52, Смышляев Станислав Витальевич
<[email-masked]<mailto:[email-masked]> <mailto:[email-masked]>> написал(а):

Dear Yoav,

1) Yes, Kuznyechik is the new Russian cipher. It is defined in RFC
7801.
That’s why the current request (and the draft it refers to) is only
about TLS 1.2 so far.

Best regards,
Stanislav Smyshlyaev

9 янв. 2019 г., в 21:39, Yoav Nir <[email-masked]<mailto:[email-masked]>
<mailto:[email-masked]>> написал(а):

Hi, Evgeny.

We’ll give the answer in a few days. First, I’d like to ask a few
clarifying questions:
If I understand correctly, the Kuznyechik ciphers in this document is
the new GOST algorithms, right?
I have noticed that this is only for TLS 1.2.  Why not TLS 1.3?
Section 10 mentions that there are existing implementations that use
the value {0x00,0x81} for TLS_GOSTR341112_256_WITH_28147_CNT_IMIT.  I
see in the IANA registry <https://www.iana.org/assignments/tls-
parameters/tls-parameters.xml#tls-parameters-4> that this value is
free.  Do you want to re-use it?

Thanks

Yoav

On 9 Jan 2019, at 15:16, Евгений Алексеев <geni-
cmc=[email-masked]<mailto:cmc=[email-masked]> <mailto:geni-
cmc=[email-masked]<mailto:cmc=[email-masked]>>> wrote:

Hello!

[email-masked]<mailto:[email-masked]> <mailto:[email-masked]>

---

From: Benjamin Kaduk <[email-masked]>
Date: Fri, 1 Feb 2019 22:32:56 -0600

On Fri, Feb 01, 2019 at 09:30:06PM +0000, Смышляев Станислав Витальевич wrote:
>    Let me correct you a little here, if you don't mind: these three are also
>    elliptic curve ones (they are defined in RFC 4357 along with finite field
>    ones, but these three are elliptic curves, unlike GOST R 34.10-94
>    parameters, which were finite field ones). So all TBD6-TBD12 should start
>    at 34. 
> 
>      None of these are IETF-endorsed algorithms, so the Recommended column is
>      'N'.  The numbers are fine, but I believe that no specific numbers were
>      requested, so any numbers should be OK.
> 
>    is perfect, but another one ({0xFF, 0x83} collides with a privately used
>    (by someone) old SSL_RSA_WITH_3DES_EDE_CBC_MD5. 

Do we know anything more about this private use?  It may be worth writing a
brief document noting it and marking it as such in the registry.

-Ben

>    Of course, "N" in "Recommended" column for all of them. 
>    Thank you very much!
>    Best regards,
>    Stanislav

---

From: Смышляев Станислав Витальевич <[email-masked]>
Date: Sat, 2 Feb 2019 07:20:20 +0000

Dear Benjamin,

I haven't seen this SSL_RSA_WITH_3DES_EDE_CBC_MD5 = 0xFF83 in real life myself - found it in https://opensource.apple.com/source/Security/Security-55163.44/libsecurity_ssl/Security/CipherSuite.h?txt. And it is marked as "for SSL 2 cipher kinds which are not specified for SSL 3". So it seems that it's old as hell and may not be worth specifying it. 

P.S.: Regarding particular numbers for GOSTs: I don't think that it will be a real problem if that 0xFF83 goes to a GOST suite defined for TLS 1.2. I just mentioned that, other things being equal, I would prefer {0xFF, 0x89} and {0xFF, 0x88}, since it is used in preliminary implementations - but not in widely available ones yet, so there won't be a huge problem to change to {0xFF, 0x83} and {0xFF, 0x84}.

And {0xFF, 0x85} for TLS_GOSTR341112_256_WITH_28147_CNT_IMIT is actually widely used in Russia, so this particular number is quite important.

Best regards,

-----Original Message-----
From: Benjamin Kaduk <[email-masked]> 
Sent: Saturday, February 2, 2019 7:33 AM
To: Смышляев Станислав Витальевич <[email-masked]>
Cc: Yoav Nir <[email-masked]>; [email-masked]; [email-masked]; Коллегин Максим Дмитриевич <[email-masked]>; Алексеев Евгений Константинович <[email-masked]>; [email-masked]; Смышляева Екатерина Сергеевна <[email-masked]>; Белявский Дмитрий <[email-masked]>
Subject: Re: [Tls-reg-review] [IANA #1135278] Re: Request to register value in TLS bar registry (tls-parameters)

>    (by someone) old SSL_RSA_WITH_3DES_EDE_CBC_MD5. 

Do we know anything more about this private use?  It may be worth writing a brief document noting it and marking it as such in the registry.

-Ben

---

From: Смышляев Станислав Витальевич <[email-masked]>
Date: Thu, 7 Feb 2019 20:15:10 +0000

Dear Amanda, Yoav, Nick and Rich,

Thank you very much for the great news!

Best regards,
Stanislav

> 7 февр. 2019 г., в 22:47, Amanda Baber via RT <[email-masked]> написал(а):
> 
> Hi all,
> 
> We've completed the registrations for draft-smyshlyaev-tls12-gost-suites.
> 
> In the TLS Cipher Suites registry:
> 
> Value: 0xC1,0x00    
> Description: TLS_GOSTR341112_256_WITH_KUZNYECHIK_CTR_OMAC    
> DTLS-OK: N
> Recommended: N    
> Reference: draft-smyshlyaev-tls12-gost-suites]
> 
> Value: 0xC1,0x01
> Description: TLS_GOSTR341112_256_WITH_MAGMA_CTR_OMAC
> DTLS-OK: N
> Recommended: N    
> Reference: draft-smyshlyaev-tls12-gost-suites]
> 
> Value: 0xC1,0x02
> Description: TLS_GOSTR341112_256_WITH_28147_CNT_IMIT
> DTLS-OK: N
> Recommended: N    
> Reference: draft-smyshlyaev-tls12-gost-suites]
> 
> In the TLS SignatureAlgorithm registry:
> 
> Value: 64
> Description: gostr34102012_256
> DTLS-OK: Y
> Reference: [draft-smyshlyaev-tls12-gost-suites]
> 
> Value: 65
> Description: gostr34102012_512
> DTLS-OK: Y
> Reference: [draft-smyshlyaev-tls12-gost-suites]
> 
> In the TLS Supported Groups registry:
> 
> Value    Description    DTLS-OK    Recommended      Reference 
> 34    GC256A    Y    N    [draft-smyshlyaev-tls12-gost-suites]    
> 35    GC256B    Y    N    [draft-smyshlyaev-tls12-gost-suites]    
> 36    GC256C    Y    N    [draft-smyshlyaev-tls12-gost-suites]    
> 37    GC256D    Y    N    [draft-smyshlyaev-tls12-gost-suites]    
> 38    GC512A    Y    N    [draft-smyshlyaev-tls12-gost-suites]    
> 39    GC512B    Y    N    [draft-smyshlyaev-tls12-gost-suites]    
> 40    GC512C    Y    N    [draft-smyshlyaev-tls12-gost-suites]
> 
> In the ClientCertificateType Identifiers registry:
> 
> Value: 67
> Description: gost_sign256
> DTLS-OK: Y
> Reference: [draft-smyshlyaev-tls12-gost-suites]
> 
> Value: 68
> Description: gost_sign512
> DTLS-OK: Y
> Reference: [draft-smyshlyaev-tls12-gost-suites]
> 
> Please see