Subject: [Spasm] Change of Algorithms: Key Management Algorithms

From: Jim Schaad <[email-masked]>
Date: Mon, 22 Aug 2016 21:31:51 -0700

This message looks at Key Management Algorithms.  Please restrict your
discussions to this set of algorithms, I will be sending out messages on
other algorithms over time.

Current Document for S/MIME 3.1

MUST: RSA Encryption
MUST: AES-128 Key Wrap
SHOULD+: RSAES-OAEP
SHOULD-: ECDH-ES w/ DH

Key Sizes:
RSA and DH - Encrypt
SHOULD NOT          key <= 1023
SHOULD           1024 <= key <= 2048
MAY                  2048 < size

RSA and DH - Decryption
MAY                     key <= 1023
MUST    1024 <= key < 2048
MAY       2048 < key

Proposed for S/MIME 3.5

MUST:   ECDH-ES w/ P-256, ECDH-ES w/ X25519
MUST: AES-128 KW, AES-256 KW (Language - must match key size of CEK
algorithm and KW algorithm)
MUST-:  RSA Encryption
SHOULD+: RSAES-OAEP
Historic: ECDH-ES w/ DH

Sizes:
RSA - Encrypt and Decrypt
Historic       key size < 2048
MUST       2048 <= key size <= 4096   ( if RSA supported)
MAY       4098 < key size

Reasoning:
Assuming that the world is currently headed in the ECDH world rather than
RSA-OAEP.
Assume that there is enough not NIST sediment that both key types are
needed.

Questions:

At this time, I have no specific questions.

Jim

---

From: Russ Housley <[email-masked]>
Date: Tue, 23 Aug 2016 10:51:39 -0400

> other algorithms over time.

I appreciate the desire to divide and conquer.  However, I think the new CFRG curves should appear at the same level across all of the algorithms.

So, if X25519 is a MUST for key management, then EdDSA with the same curve should also be a MUST.

On the other hand, if X25519 is a SHOULD+ for key management, then EdDSA with the same curve should also be a SHOULD+.

Russ

---

From: Sean Turner <[email-masked]>
Date: Tue, 23 Aug 2016 21:02:08 -0400

> On Aug 23, 2016, at 00:31, Jim Schaad <[email-masked]> wrote:
> 
> SHOULD+: RSAES-OAEP
> 
> Reasoning:

If we’re thinking folks are moving towards ECDH-ES (w/ either X25519 or P-256) shouldn’t we be making RSAES-OAEP a SHOULD-? I mean are really thinking that it’ll be “promoted” to a MUST?

spt

---

From: Jim Schaad <[email-masked]>
Date: Tue, 23 Aug 2016 19:58:51 -0700

This corresponds to what is currently in my document for signature
algorithms - 

MUST support EdDSA  25519.

Jim

> -----Original Message-----
> From: Russ Housley [mailto:[email-masked]]
> Sent: Tuesday, August 23, 2016 7:52 AM
> To: Jim Schaad <[email-masked]>
> Cc: SPASM <[email-masked]>
> Subject: Re: [Spasm] Change of Algorithms: Key Management Algorithms
> 
> Jim:
> 
> > discussions to this set of algorithms, I will be sending out messages
> > on other algorithms over time.
> 
> I appreciate the desire to divide and conquer.  However, I think the new
CFRG
> curves should appear at the same level across all of the algorithms.
> 
> On the other hand, if X25519 is a SHOULD+ for key management, then EdDSA
> with the same curve should also be a SHOULD+.
> 
> Russ=