Subject: Re: [saag] RFC 6979, Deterministic Signatures for DSA/ECDSA using SHA3?

From: Jeffrey Walton <[email-masked]>
Date: Sun, 3 Apr 2016 18:56:40 -0400

Thanks Quynh.

> One can use SHA3-224, SHA3-256, SHA3-384 and SHA3-512 as drop-in replacements for SHA2s in the HMAC construction.

Would it be possible to provide some test vectors in RFC 4231,
HMAC-SHA Identifiers and Test Vectors
(https://tools.ietf.org/html/rfc4231).

I feel much better when I can test the results against something.

> In addition, we are specifying two more efficient MAC constructions from Keccak.
>
> The first one is a single-pass MAC which does not use the HMAC construction to produce Mac tags.

Is this the concatenation of the key and message? I.e., 'tag = key' ||
data? Or maybe even 'tag = data || key'? Or maybe something else?

> The second one is to use the SHAKE128 and SHAKE256 in the HMAC construction.  We are working on a formal specification of the SHAKEs being used as fixed output-length hash functions. Fixed output-length hash functions can be used in the HMAC construction.
>

Sorry to ask basic questions. I despise non-interop'ing
implementations. I find the the easiest way to avoid it is to provide
a full specification with test vectors.

Thanks again.

Jeff

---

From: "Dang, Quynh (Fed)" <[email-masked]>
Date: Mon, 4 Apr 2016 00:33:09 +0000

Hi Jeffrey, 

________________________________________
From: Jeffrey Walton <[email-masked]>
Sent: Sunday, April 3, 2016 6:56 PM
To: Dang, Quynh (Fed)
Cc: [email-masked]
Subject: Re: [saag] RFC 6979, Deterministic Signatures for DSA/ECDSA using SHA3?

Thanks Quynh.

Examples of HMAC with SHA3-224, SHA3-256, SHA3-384 and SHA3-512 are at the bottom of this page: http://csrc.nist.gov/groups/ST/toolkit/examples.html and their OIDs are here: http://csrc.nist.gov/groups/ST/crypto_apps_infra/csor/algorithms.html#Hash

I hope we'll publish a draft specification very soon! 

Agreed!  

Thanks again.

Jeff

Regards,
Quynh.

---

From: "Dang, Quynh (Fed)" <[email-masked]>
Date: Fri, 8 Apr 2016 20:53:30 +0000

Hi Jeffrey and all,

We just sent out draft specifications of CSHAKEs (customized versions of the SHAKEs in FIPS 202) and three derived functions from the CSHAKEs: KMAC, TupleHash and Fast Parallel Hash.

Please see the emails from John Kelsey to the hash forum at [email-masked] today with the Subject lines of "KMAC, TupleHash, and Fast Parallel Hash" and "Customized Shake" for more details! 

The documents are attached for your convenience. 

For a general good security practice , output bits from a SHAKE or any other function must not be used for more than one purpose (output bits must not be reused).

Your comments for NIST will be appreciated.

Regards,
Quynh. 
________________________________________
From: saag <[email-masked]> on behalf of Dang, Quynh (Fed) <[email-masked]>
Sent: Sunday, April 3, 2016 8:33 PM
To: [email-masked]
Cc: [email-masked]
Subject: Re: [saag] RFC 6979, Deterministic Signatures for DSA/ECDSA using SHA3?

Hi Jeffrey,

Thanks Quynh.

Agreed!

Thanks again.

Jeff

Regards,
Quynh.
_______________________________________________
saag mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/saag