Subject: Mandatory to implement key wrap algorithm for S/MIME summary

From: "Blake Ramsdell" <[email-masked]>
Date: Sat, 2 Sep 2000 14:01:56 -0700

It appears that we have reached at least preliminary consensus for the
mandatory to implement algorithms for S/MIME.  Note that these mandatory to
implement algorithms are not for CMS in general, but for the S/MIME profile
of CMS.

1. The mandatory to implement algorithms should change in light of the
patent expiration for RSA.

2. The use of RSA as the mandatory to implement key wrapping algorithm is
acceptable, and the mode of operation will be PKCS #1 v1.5, not OAEP.  This
seems to reflect the reasoned discussions of at least ten working group
participants.  This will include adding a security consideration note that
explains the attack and points to a descriptive reference.

3. The use of Diffie-Hellman will only be included for backward
compatibility, and thus can be a SHOULD implement.

If we are going to use the PKCS #1 v1.5 implementation of RSA key wrapping,
then we should document the concerns about its use, and potentially point to
an RFC or other document that has a full explanation (as Paul pointed out
earlier).

Based on this list, I believe that enough information exists to move
draft-ramsdell-smime31-msg and draft-ramsdell-smime31-cert into the working
group, and start finishing this up.

Blake

---

From: "Blake Ramsdell" <[email-masked]>
Date: Sat, 2 Sep 2000 14:05:16 -0700

One more thing -- it may be important to do some kind of revision to the
working group charter if we would like to finish this up.  Based on the
level of interest both on the mailing list and at the meeting in Pittsburgh,
it seems like a no-brainer and that people are interested in pursuing this
in the working group, and the charter should be amended.

Blake

>  -----Original Message-----
> From: 	Blake Ramsdell  
> Sent:	Saturday, September 02, 2000 2:02 PM
> To:	[email-masked]'
> Subject:	Mandatory to implement key wrap algorithm for S/MIME summary
> 
> mandatory to implement algorithms for S/MIME.  Note that these mandatory
> to implement algorithms are not for CMS in general, but for the S/MIME
> profile of CMS.
> 
> acceptable, and the mode of operation will be PKCS #1 v1.5, not OAEP.
> This seems to reflect the reasoned discussions of at least ten working
> group participants.  This will include adding a security consideration
> note that explains the attack and points to a descriptive reference.
> 
> If we are going to use the PKCS #1 v1.5 implementation of RSA key
> wrapping, then we should document the concerns about its use, and
> potentially point to an RFC or other document that has a full explanation
> (as Paul pointed out earlier).
> 
> draft-ramsdell-smime31-msg and draft-ramsdell-smime31-cert into the
> working group, and start finishing this up.
> 
> Blake

---

From: "Pawling, John" <[email-masked]>
Date: Tue, 5 Sep 2000 12:42:19 -0400

All,

Blake stated: "Note that these mandatory to implement algorithms are not for
CMS in general, but for the S/MIME profile of CMS."  I have the following
comments:  

RFC 2630 (CMS), section 12.3.1, states: "CMS implementations must include
key agreement using X9.42 Ephemeral-Static Diffie-Hellman."  To be
consistent with the working group's consensus, I believe that this text
needs to be changed to: "CMS implementations should include key agreement
using X9.42 Ephemeral-Static Diffie-Hellman."   

RFC 2630, section 12.3.2, states: "CMS implementations should include key
transport using RSA." To be consistent with the working group's consensus, I
believe that this text needs to be changed to: "CMS implementations must
include key transport using RSA."   

RFC 2630, section 12.2, states: "CMS implementations must include DSA.  CMS
implementations may include RSA."  To be consistent with the working group's
consensus, I believe that this text needs to be changed to: "CMS
implementations must include both DSA and RSA." 

============================================
John Pawling, [email-masked]
Wang Government Services, Inc.,
A Getronics Company
============================================

---

From: "David P. Kemp" <[email-masked]>
Date: Tue, 5 Sep 2000 17:13:17 -0400 (EDT)

John,

I agree with Blake's implication that CMS "should not" (little letters)
contain algorithm requirements; conformance should be controlled
exclusively by specifications which reference CMS.  This enables CMS to
remain stable as opinions concerning algorithms change.  Where would we
be if X.509 said every certificate-using application MUST support
id-sa-sqMod-nWithRSA signatures?

I believe the statements quoted below should be removed without replacement
in the next version of CMS.

Dave

> From: "Pawling, John" <[email-masked]>
> To: "[email-masked]'" <[email-masked]>
> Subject: RE: Mandatory to implement key wrap algorithm for S/MIME summary
> Date: Tue, 5 Sep 2000 12:42:19 -0400 
> 
> All,
>

---

From: "Pawling, John" <[email-masked]>
Date: Wed, 6 Sep 2000 12:01:06 -0400

All,

Since RFC 2630 (CMS) will be used as the standard security protocol for
several communication protocols that may have different (and changing) sets
of algorithm implementation requirements, I agree with Dave Kemp's
recommendation to change the text in RFC 2630 stating the algorithm
implementation requirements.  I believe that it is appropriate for RFC 2630
(or an appendix to RFC 2630) to define how algorithms are used with the CMS
security protocol, but should not specify algorithm implementation
requirements.  For each communication protocol, a separate profile should be
developed specifying the algorithm implementation requirements for using RFC
2630 with that communication protocol.  For example, the S/MIME v3 algorithm
implementation requirements should be stated in the revised S/MIME v3
Message Specification (as proposed by Blake).  

Recommend the following changes to RFC 2630:

1) Section 12.1: 

OLD: "CMS implementations must include SHA-1.  CMS implementations should
include MD5."  

NEW: "This section describes how the SHA-1 and MD5 digest algorithms are
used with CMS."

2) Section 12.2:

OLD: "CMS implementations must include DSA.  CMS implementations may include
RSA." 

NEW: "This section describes how the DSA and RSA signature algorithms are
used with CMS."   

3) Section 12.3.1: 

OLD: "CMS implementations must include key agreement using X9.42
Ephemeral-Static Diffie-Hellman."  

NEW: "This section describes how key agreement is implemented in CMS using
the X9.42 Ephemeral-Static Diffie-Hellman algorithm."    

4) Section 12.3.1:

OLD: "CMS implementations must include key agreement of Triple-DES pairwise
key-encryption keys and Triple-DES wrapping of Triple-DES content-encryption
keys.  CMS implementations should include key agreement of RC2 pairwise
key-encryption keys and RC2 wrapping of RC2 content-encryption keys.  The
key wrap algorithm for Triple-DES and RC2 is described in section 12.3.3."

NEW: "Section 12.3.3.1 specifies the key wrap algorithm for use with CMS for
key agreement of Triple-DES pairwise key-encryption keys and Triple-DES
wrapping of Triple-DES content-encryption keys.  Section 12.3.3.2 specifies
the key wrap algorithm for use with CMS for key agreement of RC2 pairwise
key-encryption keys and RC2 wrapping of RC2 content-encryption keys."

5) Section 12.3.2: 

OLD: "CMS implementations should include key transport using RSA.  RSA
implementations must include key transport of Triple-DES content-encryption
keys.  RSA implementations should include key transport of RC2
content-encryption keys."

NEW: "This section describes how key transport is implemented in CMS using
RSA in conjunction with Triple-DES and RC2 content-encryption keys."  

6) Section 12.4:

OLD: "CMS implementations must include Triple-DES in CBC mode.  CMS
implementations should include RC2 in CBC mode."

NEW: "This section describes how the Triple-DES (in CBC mode) and RC2 (in
CBC mode) content encryption algorithms are used with CMS."

7) Section 12.6: 

OLD: "CMS implementations must include encryption of a Triple-DES
content-encryption key with a Triple-DES key-encryption key using the
algorithm specified in Sections 12.6.2 and 12.6.3.  CMS implementations
should include encryption of a RC2 content-encryption key with a RC2
key-encryption key using the algorithm specified in Sections 12.6.4 and
12.6.5."  

NEW: "Sections 12.6.2 and 12.6.3 specify the algorithm for use with CMS to
encrypt a Triple-DES content-encryption key with a Triple-DES key-encryption
key.  Sections 12.6.4 and 12.6.5 specify the algorithm for use with CMS to
encrypt a RC2 content-encryption key with a RC2 key-encryption key."  

8) Section 12, intro: 

OLD: "This section lists the algorithms that must be implemented.
Additional algorithms that should be implemented are also included."

NEW: "This section describes how selected algorithms are used with CMS."

Recommend that the revised S/MIME v3 Message Specification should state the
S/MIME working group's consensus regarding each of the aforementioned
algorithm implementation requirements.