Subject: [Spasm] Change of Algorithms: Digest Algorithms Take 2

From: Jim Schaad <[email-masked]>
Date: Tue, 16 Aug 2016 14:45:34 -0700

This message looks at Digest Algorithms.  Please restrict your discussion to
this set of algorithms.  I will be sending out messages on other algorithms
over time.

Note:  Digest Algorithms are used for computing the digest of the content.

These are not the "same" as the digest algorithms that are used as part of
signature algorithms.  There may be things one wants to try and keep
similar, as we suggest that you use the same digest algorithm, but they are
not the same things.

Current Document for S/MIME 3.1

MUST: SHA-256

SHOULD-: SHA-1, MD5(for backwards compatibility)

Proposed for S/MIME 3.5

MUST: SHA-256

SHOULD: SHA-512

Historic: SHA-1, MD5

Questions:

1.      There is only one MUST and no path forward.  Is this a problem that
needs to be dealt with?  EdDSA25519 uses SHA-512 under the covers, does that
mean we should make SHA-512 at least a SHOULD here?

Take 2 status:  I have added SHA-512 to the list of SHOULDs because it
vaguely matches what is used by EdDSA 25519.  It is not really needed as
EdDSA 25519 is targeted as the 128-bit level which is what SHA-256 supports
but an implementation of EdDSA 25519 is probably going to have it available.

2.      Is there anybody who wants to standup and argue for adopting in any
of the SHA-3 algorithms?

Take 2 status:  There have been a couple of pro SHAKE people, a couple of
anti SHA-3 people and a larger segment that seems to say 'Meh'.  My take at
this time is that there does not seem to be support to adding this right
now.

Jim

---

From: Russ Housley <[email-masked]>
Date: Tue, 16 Aug 2016 17:50:56 -0400

Jim:

Just responding to the first question.

> 1.      There is only one MUST and no path forward.  Is this a problem that needs to be dealt with?  EdDSA25519 uses SHA-512 under the covers, does that mean we should make SHA-512 at least a SHOULD here?
> 
> Take 2 status:  I have added SHA-512 to the list of SHOULDs because it vaguely matches what is used by EdDSA 25519.  It is not really needed as EdDSA 25519 is targeted as the 128-bit level which is what SHA-256 supports but an implementation of EdDSA 25519 is probably going to have it available.

I think that EdDSA25519 and SHA-512 should both be SHOULD algorithms.  Your other message has EdDSA25519 at the MUST level, and I suggested moving it to the SHOULD level to make these match.

Russ

---

From: Jim Schaad <[email-masked]>
Date: Tue, 16 Aug 2016 14:55:52 -0700

From: Spasm [mailto:[email-masked]] On Behalf Of Russ Housley
Sent: Tuesday, August 16, 2016 2:51 PM
To: Jim Schaad <[email-masked]>
Cc: SPASM <[email-masked]>
Subject: Re: [Spasm] Change of Algorithms: Digest Algorithms Take 2

Jim:

I think that EdDSA25519 and SHA-512 should both be SHOULD algorithms.  Your
other message has EdDSA25519 at the MUST level, and I suggested moving it to
the SHOULD level to make these match.

[JLS] It is not clear to me that there is an advantage from a security
impedance matching to say that one needs to use SHA-512 with EdDSA25519.
As I said above, SHA-256 matches up just fine with EdDSA25519.  The story
would be different if we had required support for EdDSA448.   Do you have a
different understanding?  Is there a reasoning to making these two items
match?

Jim

Russ

---

From: Russ Housley <[email-masked]>
Date: Wed, 17 Aug 2016 15:59:38 -0400

Jim:

> [JLS] It is not clear to me that there is an advantage from a security impedance matching to say that one needs to use SHA-512 with EdDSA25519.   As I said above, SHA-256 matches up just fine with EdDSA25519.  The story would be different if we had required support for EdDSA448.   Do you have a different understanding?  Is there a reasoning to making these two items match?

My reading of section 5.1 of draft-irtf-cfrg-eddsa-06 is that SHA-512 is mandated.  It is fully baked into the algorithm description.  For this reason, not the security impedance match, I think that both EdDSA25519 and SHA-512 ought to be SHOULD algorithms (or they could both be MUST algorithms).  Your recent proposal had one as a SHOULD and the other as a MUST.

Russ