Subject: Re: [Spasm] Change of Algorithms: Signature Algorithms

From: Blake Ramsdell <[email-masked]>
Date: Mon, 1 Aug 2016 02:16:54 -0700

On Jul 31, 2016 11:06 PM, "Jim Schaad" <[email-masked]> wrote:
> Proposed for S/MIME 3.5
>
> MUST: RSA-PSS w/ SHA-256, ECDSA P-256 w/ SHA-256, EdDSA25519

Why are there three MUST algorithms?

---

From: "Santosh Chokhani" <[email-masked]>
Date: Mon, 1 Aug 2016 10:14:00 -0400

Jim,

For S/MIME 3.5 is SHA 256 with P521 intentional or typo?

-----Original Message-----
From: Spasm [mailto:[email-masked]] On Behalf Of Jim Schaad
Sent: Monday, August 1, 2016 2:06 AM
To: 'SPASM' <[email-masked]>
Subject: [Spasm] Change of Algorithms: Signature Algorithms

This message looks at Signature Algorithms.  Please restrict your
discussions to this set of algorithms, I will be sending out messages on
other algorithms over time.

Current Document for S/MIME 3.1

MUST:   RSA w/ SHA-256
SHOULD+:  DSA w/ SHA-256, RSASSA-PSS w/ SHA-256
SHOULD-:  RSA w/ SHA-1, DSA w/SHA-1, RSA w/ MD5
Historic:

Key Sizes:
RSA and DSA - sign
SHOULD NOT            Key size <= 1023
SHOULD      1024 <= key size <= 2048
MAY            2048 < key size   

RSA and DSA - Verify
MAY                key size <= 1023
MUST      1024 <= key size <= 2048
MAY        2048 < key size

RSA - Certificate Verify
MAY             key size <= 1023
MUST  1024 <= key size <= 4096
MAY      4096  < key size

DSA - Certificate Verify
MAY             key size <= 1023
MUST    1024 <= key size <= 3072

Proposed for S/MIME 3.5

MUST: RSA-PSS w/ SHA-256, ECDSA P-256 w/ SHA-256, EdDSA25519
MUST-: RSA w/ SHA-256
SHOULD+:
SHOULD:  RSA-PSS w/ SHA-512, ECDSA P-521 w/ SHA-256, EdDSA448
SHOULD-: DSA w/ SHA-256
Historic: RSA w/ SHA-1, DSA w/ SHA-1, RSA w/ MD5

Key Sizes:
RSA and DSA - sign
SHOULD NOT            Key size <= 2048
SHOULD      2048 <= key size <= 4096
MAY             4096 < key size   

RSA and DSA - Verify
MAY                key size <= 2048
MUST      2048 <= key size <= 4096
MAY        4096 < key size

RSA - Certificate Verify
MAY             key size <= 2048
MUST  2048 <= key size <= 4096
MAY      4096  < key size

DSA - Certificate Verify
MAY             key size <= 1023
MUST   1024 <= key size <= 3072

Questions:

1.  Should DSA be dropped to historic for messages and just left as SHOULD-
for certificates, I don't know how many DSA certificates actually exist.

2. I have changed to lower limits on RSA but not DSA for certificate
verification - should it be changed as well?  Again I don't know how many
DSA certificates exist.

3.  I don't think that any statements for ECDSA on key size need to be made
separately from the algorithm support list.  Does any body disagree?

Jim

_______________________________________________
Spasm mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/spasm

---

From: Jim Schaad <[email-masked]>
Date: Mon, 1 Aug 2016 08:22:55 -0700

Can’t really get rid of RSA as a signature algorithm.

Need the P-256 algorithm for the world of NIST

Need EdDSA for the world of NIST is not to be trusted.

Jim

From: Spasm [mailto:[email-masked]] On Behalf Of Blake Ramsdell
Sent: Monday, August 01, 2016 2:17 AM
To: Jim Schaad <[email-masked]>
Cc: SPASM <[email-masked]>
Subject: Re: [Spasm] Change of Algorithms: Signature Algorithms

---

From: Jim Schaad <[email-masked]>
Date: Mon, 1 Aug 2016 08:23:48 -0700

Yes, it is a typo.  It should have been P521 w/ SHA 512.

jim

> From: Santosh Chokhani [mailto:[email-masked]]
> Sent: Monday, August 01, 2016 7:14 AM
> To: 'Jim Schaad' <[email-masked]>; 'SPASM' <[email-masked]>
> Subject: RE: [Spasm] Change of Algorithms: Signature Algorithms
> 
> Jim,
> 
discussions to
> this set of algorithms, I will be sending out messages on other algorithms
over
> time.
> 1.  Should DSA be dropped to historic for messages and just left as
SHOULD- for
> certificates, I don't know how many DSA certificates actually exist.
> 
verification -
> should it be changed as well?  Again I don't know how many DSA
certificates
> exist.

---

From: Sean Turner <[email-masked]>
Date: Tue, 2 Aug 2016 10:15:08 -0400

> Proposed for S/MIME 3.5

I’m really thinking this should be v4, but I guess that’s for another thread.

> SHOULD:  RSA-PSS w/ SHA-512, ECDSA P-521 w/ SHA-256, EdDSA448

{snark}Sigh I guess we’ll do this for those that are paranoid … here’s to the race to “11”.{/snark}

> MUST   1024 <= key size <= 3072

I’m sure there was a reason to include the MAYs back in the day but maybe we can drop them entirely?  I mean you may shoot yourself in the foot, but we don’t MAY that.  If they’re going to remain I think they’re supposed to be "<= 2047” otherwise 2048 is both a MUST an a MAY.

> for certificates, I don't know how many DSA certificates actually exist.

I’m all for moving DSA to historic.  I’m also not sure how many DSA certificates are out there either, but the real question is if anybody is actually going to update their code to do S/MIME v4 with DSA.  I doubt it.

I know it’s not apples to apples but we asked about DSA certificates in the TLS WG we got crickets.

> verification - should it be changed as well?  Again I don't know how many

See 1 so this is OBE.

> separately from the algorithm support list.  Does any body disagree?

I agree with you that I think we could drop these.  I’ve not seen people go oh an ECDSA key on p-256 needs a 192-bit key.

spt

---

From: Michael Richardson <[email-masked]>
Date: Tue, 02 Aug 2016 12:11:13 -0400

Sean Turner <[email-masked]> wrote:
    > I’m sure there was a reason to include the MAYs back in the day but
    > maybe we can drop them entirely?  I mean you may shoot yourself in the
    > foot, but we don’t MAY that.  If they’re going to remain I think
    > they’re supposed to be "<= 2047” otherwise 2048 is both a MUST an a
    > MAY.

The reason to include a MAY is so that you can interoperate with an old
product (where it was a SHOULD or MUST).  Having it in the code base doesn't
mean it is enabled...  We aren't all running browsers that can upgraded willy-nilly...

Having it in the code base, of course, might mean having a bug.

--
Michael Richardson <[email-masked]>, Sandelman Software Works
 -= IPv6 IoT consulting =-

---

From: Sean Turner <[email-masked]>
Date: Tue, 2 Aug 2016 15:11:48 -0400

> Having it in the code base, of course, might mean having a bug.

I can get on board with that rationale for the MAY, but it might be better to be explicit about what’s required to interop with older versions.

spt