Subject: [Spasm] Change of Algorithms: Signature Algorithms

From: Jim Schaad <[email-masked]>
Date: Sun, 31 Jul 2016 23:06:02 -0700

This message looks at Signature Algorithms.  Please restrict your
discussions to this set of algorithms, I will be sending out messages on
other algorithms over time.

Current Document for S/MIME 3.1

MUST:   RSA w/ SHA-256
SHOULD+:  DSA w/ SHA-256, RSASSA-PSS w/ SHA-256
SHOULD-:  RSA w/ SHA-1, DSA w/SHA-1, RSA w/ MD5
Historic:

Key Sizes:
RSA and DSA - sign
SHOULD NOT            Key size <= 1023
SHOULD      1024 <= key size <= 2048
MAY            2048 < key size   

RSA and DSA - Verify
MAY                key size <= 1023
MUST      1024 <= key size <= 2048
MAY        2048 < key size

RSA - Certificate Verify
MAY             key size <= 1023
MUST  1024 <= key size <= 4096
MAY      4096  < key size

DSA - Certificate Verify
MAY             key size <= 1023
MUST    1024 <= key size <= 3072

Proposed for S/MIME 3.5

MUST: RSA-PSS w/ SHA-256, ECDSA P-256 w/ SHA-256, EdDSA25519
MUST-: RSA w/ SHA-256
SHOULD+:
SHOULD:  RSA-PSS w/ SHA-512, ECDSA P-521 w/ SHA-256, EdDSA448
SHOULD-: DSA w/ SHA-256
Historic: RSA w/ SHA-1, DSA w/ SHA-1, RSA w/ MD5

Key Sizes:
RSA and DSA - sign
SHOULD NOT            Key size <= 2048
SHOULD      2048 <= key size <= 4096
MAY             4096 < key size   

RSA and DSA - Verify
MAY                key size <= 2048
MUST      2048 <= key size <= 4096
MAY        4096 < key size

RSA - Certificate Verify
MAY             key size <= 2048
MUST  2048 <= key size <= 4096
MAY      4096  < key size

DSA - Certificate Verify
MAY             key size <= 1023
MUST   1024 <= key size <= 3072

Questions:

1.  Should DSA be dropped to historic for messages and just left as SHOULD-
for certificates, I don't know how many DSA certificates actually exist.

2. I have changed to lower limits on RSA but not DSA for certificate
verification - should it be changed as well?  Again I don't know how many
DSA certificates exist.

3.  I don't think that any statements for ECDSA on key size need to be made
separately from the algorithm support list.  Does any body disagree?

Jim