Subject: [IPP] 5100.11 "job-password-encryption-supported" - what SHA version does 'sha' keyword indicate?

From: "Kennedy, Smith (Wireless Architect)" <[email-masked]>
Date: Thu, 12 Jun 2014 20:52:34 +0000

Greetings,

PWG 5100.11 (JPS2) defines the “job-password-encryption-supported” attribute.  One of the keywords defined in JPS2 is ’sha’.  Neither the keyword nor the description is clear as to which SHA generation is being used.  Is this SHA-0 or SHA-1?  Do we need to define additional keywords to bring this up-to-date?

Smith

/**
    Smith Kennedy
    ATB Wireless Architect - PPS
    Hewlett-Packard Co.
*/

_______________________________________________
ipp mailing list
[email-masked]
https://www.pwg.org/mailman/listinfo/ipp

---

From: "Manchala, Daniel" <[email-masked]>
Date: Thu, 12 Jun 2014 23:07:24 +0000

Smith,

Yes, we need additional keywords.
sha-1 for the 160 bit digest SHA algorithm
sha-256 for the 256 bit digest SHA-256 algorithm
sha-512 likewise.

Daniel.

From: [email-masked] [mailto:[email-masked]] On Behalf Of Kennedy, Smith (Wireless Architect)
Sent: Thursday, June 12, 2014 1:53 PM
To: <[email-masked]>
Subject: [IPP] 5100.11 "job-password-encryption-supported" - what SHA version does 'sha' keyword indicate?

Greetings,

PWG 5100.11 (JPS2) defines the "job-password-encryption-supported" attribute.  One of the keywords defined in JPS2 is 'sha'.  Neither the keyword nor the description is clear as to which SHA generation is being used.  Is this SHA-0 or SHA-1?  Do we need to define additional keywords to bring this up-to-date?

Smith

/**
    Smith Kennedy

---

From: Ira McDonald <[email-masked]>
Date: Thu, 12 Jun 2014 19:17:16 -0400

Hi Daniel,

You're conflating key length with the name of the base algorithm.

There are three (totally distinct) NIST SHA algorithms:
SHA-1
SHA-2
SHA-3 (Keccak)

Note that SHA-3 is already being required in various new security standards
(international and regional ones) and IETF wants to aggressively deploy it
in new IETF protocols and architectures.

Cheers,
- Ira

Ira McDonald (Musician / Software Architect)
Co-Chair - TCG Trusted Mobility Solutions WG
Chair - Linux Foundation Open Printing WG
Secretary - IEEE-ISTO Printer Working Group
Co-Chair - IEEE-ISTO PWG Internet Printing Protocol WG
IETF Designated Expert - IPP & Printer MIB
Blue Roof Music / High North Inc
http://sites.google.com/site/blueroofmusic
http://sites.google.com/site/highnorthinc
mailto: [email-masked]
Winter  579 Park Place  Saline, MI  48176  734-944-0094
Summer  PO Box 221  Grand Marais, MI 49839  906-494-2434

On Thu, Jun 12, 2014 at 7:07 PM, Manchala, Daniel <[email-masked]
> wrote:

> *From:* [email-masked] [mailto:[email-masked]] *On Behalf Of *Kennedy,
> Smith (Wireless Architect)
> *Sent:* Thursday, June 12, 2014 1:53 PM
> *To:* <[email-masked]>
> *Subject:* [IPP] 5100.11 "job-password-encryption-supported" - what SHA
> version does 'sha' keyword indicate?
>
>
>
> Greetings,
>
>
>
> PWG 5100.11 (JPS2) defines the “job-password-encryption-supported”
> attribute.  One of the keywords defined in JPS2 is ’sha’.  Neither the
> keyword nor the description is clear as to which SHA generation is being
> used.  Is this SHA-0 or SHA-1?  Do we need to define additional keywords to
> bring this up-to-date?
>
>
>
> Smith
>
> /**
>     Smith Kennedy

---

From: Ira McDonald <[email-masked]>
Date: Thu, 12 Jun 2014 19:22:51 -0400

Hi,

Also note that SHA-1 has been DEPRECATED by NIST, IETF, and TCG standards.

It's a MUST NOT implement after sometime in 2015 in lots of new drafts,
including
some US NIAP Common Criteria Protection Profiles.

Printers need to catch up with current hash and encryption algorithms, if
they want
to get certified under CC protection profiles.

Cheers,
- Ira

On Thu, Jun 12, 2014 at 7:17 PM, Ira McDonald <[email-masked]>
wrote:

> On Thu, Jun 12, 2014 at 7:07 PM, Manchala, Daniel <
> [email-masked]> wrote:
>
>>  Smith,
>>
>>
>>

---

From: "Kennedy, Smith (Wireless Architect)" <[email-masked]>
Date: Fri, 13 Jun 2014 01:50:26 +0000

Hi Ira,

So we want a series of more precise keywords, like for instance:

- sha-224
- sha-256
- sha-384
- sha-512
- sha-512/224
- sha-512/256
- sha3-224
- sha3-256
- sha3-384
- sha3-512
- shake128
- shake256

and so on.

Smith

/**
    Smith Kennedy

On 2014-06-12, at 7:22 PM, Ira McDonald <[email-masked]> wrote:

> It's a MUST NOT implement after sometime in 2015 in lots of new drafts, including
> Printers need to catch up with current hash and encryption algorithms, if they want
> On Thu, Jun 12, 2014 at 7:17 PM, Ira McDonald <[email-masked]> wrote:
> Hi Daniel,
> 
> On Thu, Jun 12, 2014 at 7:07 PM, Manchala, Daniel <[email-masked]> wrote:
> Smith,
> 
>  
>

---

From: Michael Sweet <[email-masked]>
Date: Fri, 13 Jun 2014 10:14:37 -0400

We should look at the existing IANA registry of hash functions.  The HTTP Auth WG is also close to publishing an update of the Digest auth spec with SHA-2 (256 + 256/512) added.

>>     ATB Wireless Architect - PPS

_________________________________________________________
Michael Sweet, Senior Printing System Engineer, PWG Chair

---

From: Michael Sweet <[email-masked]>
Date: Mon, 16 Jun 2014 16:56:01 -0400

OK, the consensus at today's concall is that "sha" refers to SHA-1.  We will register the following values for SHA2:

  sha2-224
  sha2-256
  sha2-384
  sha2-512
  sha2-512_256

The latter is the 512-bit SHA-2 hash truncated to 256 bits as used in the upcoming HTTP Digest authentication update.

Once a non-draft US NIST (or other) specification is released, we will also register the following new values for SHA-3 and Shake:

  sha3-224
  sha3-256
  sha3-384
  sha3-512
  sha3-512_256
  shake-128
  shake-256

The IANA registration information for the SHA-2 registrations is:

Attributes (attribute syntax)
  Keyword Attribute Value                       Reference
  -----------------------                       ---------
job-password-encryption (type2 keyword)		[PWG5100.11]
  sha2-224
  sha2-256
  sha2-384
  sha2-512
  sha2-512_256