Updating documentation.

NOKEYCHECK=True
PiperOrigin-RevId: 267625688
GitOrigin-RevId: 4df73e541c5ef5164fe76a6aa985c095c5ff88fb

doc/bib.md

@@ -176,6 +176,12 @@ http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-56Ar2.pdf
 ### NIST-SP800-57 {#NIST-SP800-57}
 http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-57pt1r4.pdf
 
+### NIST SP800-131A {#NIST-SP800-131A}
+Transitioning the Use of Cryptographic Algorithms and Key Lengths
+https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-131Ar2.pdf
+Some notable changes: Keys with less than 112 bit security are now disallowed.
+EdDSA will be added with FIPS 186-5. TDES is disallowed after 2023.
+RSA PKCS 1 v.1.5 for encryption is disallowed after 2023.
 
 ### EnisaKeySize14 {#EnisaKeySize14}
 Enisa,
@@ -233,7 +239,7 @@ elliptic curve parameters during Diffie-Hellman key exchange
 http://www.cs.technion.ac.il/~biham/BT/
 
 ### CVE-2019-6486 {#CVE-2019-6486}
-golang/elliptic ECDH has an arithmetic error that allows to find private key
+golang/elliptic ECDH has an arithmetic error that allows to find private keys
 with an adaptive chosen message attack.
 
 <!-- mdformat on -->

doc/key_wrap.md

@@ -28,6 +28,10 @@ NIST does not define a KWP when the wrapped key is 64-bits long. RFC 3394
 specifies in Section 2, that the input for the key wrap algorithm must be at
 least two blocks and otherwise the constant field and key are simply encrypted
 with ECB as a single block.
+Other references are more clear about this. E.g.
+https://www.w3.org/TR/2002/REC-xmlenc-core-20021210/Overview.html#kw-aes128
+(Though the latest version https://www.w3.org/TR/xmlenc-core/
+simply refers to RFC 3394).
 
 # Padding oracles (KWP)
 

doc/rsa.md

@@ -45,7 +45,8 @@ attackers. Bardou et al. [[BFKLSST12]](bib.md#BFKLSST12) analyze the difficult
 of attacks based on different types of information leakage. Smart even describes
 an attack that only needs about 40 chosen ciphertexts
 [[Smart10]](bib.md#Smart10), though in this case the encryption did not use
-PKCS #1 padding.
+PKCS #1 padding. NIST disallows the use of RSA PKCS #1 v1.5 for key-agreement
+and key-transport after 2023 [[NIST-SP800-131A]]{bib.md#NIST-SP800-131A}.
 
 **Bugs**