Subject: [Spasm] Change of Algorithms: Content Encryption Algorithms - Take 2

From: Jim Schaad <[email-masked]>
Date: Sun, 7 Aug 2016 14:03:04 -0700

I have looked at the responses to the original mail and am updating the mail
to reflect what I thought I saw as comments.

This message looks at Content Encryption Algorithms.  Please restrict your
discussions to this set of algorithms, I will be sending out messages on
other algorithm times over time.

Current Document for S/MIME 3.1

MUST: AES-128 CBC

SHOULD+: AES-192 CBC and AES-256 CBC

SHOULD-: DES EDE3 CBC (tripleDES)

Historic: RC2/40

Proposed for S/MIME 3.5

MUST:  AES-192 CBC, AES-256 CBC, AES-256 GCM

MUST-: AES-128 CBC

SHOULD+: ChaCha20/Poly1305 (256-bit)

SHOULD-: AES-128 CBC

Historic: RC2/40, DES EDE3 CBC (tripleDES)

Take 2 State: With this set we now have two MUST algorithms with the same
primitive.  We are indicating that we think that ChaCha20/Poly1305 will
become a MUST in the future so we have stated a potential fail over
algorithm if AES or GCM go into the tank for any reason.   More comments are
welcome.

Questions:

1.      The jump from MUST to SHOULD- may be too aggressive for AES-128 CBC,
we should potentially state this as MUST- but I think being aggressive makes
more sense as we want to go to all AEAD algorithms in next version.

Take 2 state: Russ said that yes I was.  As I suggested on the list I have
pushed this back up to a MUST-.

2.      No recommendation for: AES-128 GCM or AES-192 GCM, should there be?
How do people feel about 128 and 192 bit algorithms?

Take 2 state: List appears to say that we should not say anything about
192-bit algorithms.  However people did not comment on the -128 vs -256
question so I have left the recommendation of AES-256 GCM alone.

3.      Do we want to downgrade all of the CBC algorithms in favor of GCM
algorithms?

Take 2 state:  SPT is the only one who commented on this.  I have a tendency
to agree with his proposal that we are adding AEAD and we should be pushing
that as the preferred algorithm.  Making a MUST statement about AES-256 CBC
seems to counter act this statement so I have removed it.

Jim

---

From: Blake Ramsdell <[email-masked]>
Date: Sun, 7 Aug 2016 14:08:26 -0700

+1 plus another one if allowed. I'm happy with this structure.

On Sun, Aug 7, 2016 at 2:03 PM, Jim Schaad <[email-masked]> wrote:

> I have looked at the responses to the original mail and am updating the
> mail to reflect what I thought I saw as comments.
>
>
>
> *MUST-: AES-128 CBC*
> *Take 2 State*: With this set we now have two MUST algorithms with the
> same primitive.  We are indicating that we think that ChaCha20/Poly1305
> will become a MUST in the future so we have stated a potential fail over
> algorithm if AES or GCM go into the tank for any reason.   More comments
> are welcome.
>
>
>
> Questions:
>
> 1.      The jump from MUST to SHOULD- may be too aggressive for AES-128
> CBC, we should potentially state this as MUST- but I think being aggressive
> makes more sense as we want to go to all AEAD algorithms in next version.
>
> *Take 2 state*: Russ said that yes I was.  As I suggested on the list I
> have pushed this back up to a MUST-.
>
>
>
> 2.      No recommendation for: AES-128 GCM or AES-192 GCM, should there
> be?  How do people feel about 128 and 192 bit algorithms?
>
> *Take 2 state*: List appears to say that we should not say anything about
> *Take 2 state*:  SPT is the only one who commented on this.  I have a
> tendency to agree with his proposal that we are adding AEAD and we should
> be pushing that as the preferred algorithm.  Making a MUST statement about
> AES-256 CBC seems to counter act this statement so I have removed it.
>
>
>
> Jim
>
>
>
>
>
>
>
> _______________________________________________
> Spasm mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/spasm
>
>

---

From: "Salz, Rich" <[email-masked]>
Date: Mon, 8 Aug 2016 13:36:05 +0000

+1.  I assume the rationale will make it into the draft.

---

From: Russ Housley <[email-masked]>
Date: Mon, 8 Aug 2016 10:21:13 -0400

I would like to see AES-128 GCM on the MUST list as well.

Russ

On Aug 7, 2016, at 5:03 PM, Jim Schaad <[email-masked]> wrote:

> I have looked at the responses to the original mail and am updating the mail to reflect what I thought I saw as comments.
>  
> This message looks at Content Encryption Algorithms.  Please restrict your discussions to this set of algorithms, I will be sending out messages on other algorithm times over time.
>  
> Take 2 State: With this set we now have two MUST algorithms with the same primitive.  We are indicating that we think that ChaCha20/Poly1305 will become a MUST in the future so we have stated a potential fail over algorithm if AES or GCM go into the tank for any reason.   More comments are welcome.
>  
> Questions:
> 1.      The jump from MUST to SHOULD- may be too aggressive for AES-128 CBC, we should potentially state this as MUST- but I think being aggressive makes more sense as we want to go to all AEAD algorithms in next version.
> 
> Take 2 state: Russ said that yes I was.  As I suggested on the list I have pushed this back up to a MUST-.
>  
> 2.      No recommendation for: AES-128 GCM or AES-192 GCM, should there be?  How do people feel about 128 and 192 bit algorithms?
> 
> Take 2 state: List appears to say that we should not say anything about 192-bit algorithms.  However people did not comment on the -128 vs -256 question so I have left the recommendation of AES-256 GCM alone.
>  
> 3.      Do we want to downgrade all of the CBC algorithms in favor of GCM algorithms?
> 
> Take 2 state:  SPT is the only one who commented on this.  I have a tendency to agree with his proposal that we are adding AEAD and we should be pushing that as the preferred algorithm.  Making a MUST statement about AES-256 CBC seems to counter act this statement so I have removed it.
>  
> Jim
>  
>  
>

---

From: Jim Schaad <[email-masked]>
Date: Mon, 8 Aug 2016 08:02:20 -0700

Why should the rationale be in the document?

> -----Original Message-----
> From: Salz, Rich [mailto:[email-masked]]
> Sent: Monday, August 08, 2016 6:36 AM
> To: Jim Schaad <[email-masked]>
> Cc: SPASM <[email-masked]>
> Subject: RE: [Spasm] Change of Algorithms: Content Encryption Algorithms -
> Take 2
>

---

From: Jim Schaad <[email-masked]>
Date: Mon, 8 Aug 2016 19:52:46 -0700

I have no problems with this, however I will channel Blake - what is the
reason for having three must algorithms at this point?  I can see that the
support delta is very small given that both 128 and 256 bit AES primitive is
required already.

Jim

From: Spasm [mailto:[email-masked]] On Behalf Of Russ Housley
Sent: Monday, August 08, 2016 7:21 AM
To: Jim Schaad <[email-masked]>
Cc: SPASM <[email-masked]>
Subject: Re: [Spasm] Change of Algorithms: Content Encryption Algorithms -
Take 2

Russ

On Aug 7, 2016, at 5:03 PM, Jim Schaad <[email-masked]
<mailto:[email-masked]> > wrote:

MUST: AES-128 CBC

Historic: RC2/40

Proposed for S/MIME 3.5

MUST-: AES-128 CBC

SHOULD-: AES-128 CBC

Questions:

Jim

_______________________________________________
Spasm mailing list
 <mailto:[email-masked]> [email-masked]
 <https://www.ietf.org/mailman/listinfo/spasm>
https://www.ietf.org/mailman/listinfo/spasm

---

From: Jim Schaad <[email-masked]>
Date: Tue, 16 Aug 2016 14:18:35 -0700

I have merged in my pull request for content encryption algorithms.   I did
add AES-128 GCM as part of that merge.

Jim

From: Spasm [mailto:[email-masked]] On Behalf Of Jim Schaad
Sent: Monday, August 08, 2016 7:53 PM
To: 'Russ Housley' <[email-masked]>
Cc: 'SPASM' <[email-masked]>
Subject: Re: [Spasm] Change of Algorithms: Content Encryption Algorithms -
Take 2

Jim

From: Spasm [mailto:[email-masked]] On Behalf Of Russ Housley
Sent: Monday, August 08, 2016 7:21 AM
To: Jim Schaad <[email-masked] <mailto:[email-masked]> >
Cc: SPASM <[email-masked] <mailto:[email-masked]> >
Subject: Re: [Spasm] Change of Algorithms: Content Encryption Algorithms -
Take 2

Russ

MUST: AES-128 CBC

Historic: RC2/40

Proposed for S/MIME 3.5

MUST-: AES-128 CBC

SHOULD-: AES-128 CBC

Questions:

Jim