Subject: Re: [Syslog] Syslog-sign: RSA support?

From: Martin Schütte <[email-masked]>
Date: Fri, 01 Aug 2008 23:50:15 +0200

Jon Callas schrieb:
> Nonetheless, if you're going to do syslog-sign over udp, there's a real 
> need to keep the signatures small.

Good point.

> That is why it is DSA. It's also why the encoding is the OpenPGP 
> encoding,  and not DER. It's all to keep things as tight as possible.

That should be more explicit.

For key blob types 'C' (PKIX) and 'P' (OpenPGP certificates) I would 
assume a 'usual' encoding in DER and OpenPGP Key Packet format respectively.

But there has to be be a better specification for blob type 'K' (public 
key) -- "raw key data" is not really well-defined.

> Obviously, if you're going to do it over TCP, or even TLS, the tightness 
> is not needed as much. However, it's still nice to have a protocol that 
> is parsimonious on data. I think ECDSA makes much more sense than RSA 
> for it.

I think this is mainly a compatibility concern for users who have 
existing PKIX certificates with RSA keys and want to use them for TLS 
and for signing.
When creating new keys for syslog-sign then DSA or ECDSA are clearly 
preferable.

-- 
Martin
_______________________________________________
Syslog mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/syslog

---

From: <[email-masked]>
Date: Thu, 7 Aug 2008 22:31:44 +0300

Martin Schütte wrote:

> existing PKIX certificates with RSA keys and want to use them for
> TLS and for signing.  When creating new keys for syslog-sign then
> DSA or ECDSA are clearly preferable.

Or existing *CAs* (inside enterprises etc.) that certify only RSA 
keys (not because there's anything wrong with DSA, but because they 
thought nobody would need it).

Best regards,
Pasi

---

From: Jon Callas <[email-masked]>
Date: Thu, 7 Aug 2008 13:58:20 -0700

> thought nobody would need it).

Yes, but. The existing design and consensus on syslog-sign is that's a  
DSA system, and doesn't require a CA. The rationale, as I said before  
comes from the days when syslog meant UDP, and size truly mattered.  
That may not matter so much today, especially if you're using TLS as a  
transport.

But that's what the existing consensus is. Do we have to, at this late  
date, throw out the existing consensus and put in RSA and CAs?

	Jon

---

From: <[email-masked]>
Date: Fri, 8 Aug 2008 00:12:07 +0300

Jon Callas wrote:

> Yes, but. The existing design and consensus on syslog-sign is that's
> a DSA system, and doesn't require a CA. The rationale, as I said
> before comes from the days when syslog meant UDP, and size truly
> mattered.  That may not matter so much today, especially if you're
> using TLS as a transport.
> 
> But that's what the existing consensus is. Do we have to, at this
> late date, throw out the existing consensus and put in RSA and CAs?

Doesn't *require* a CA, or doesn't *support* CAs?

(BTW, to me, RSA vs. DSA seems totally orthogonal to CA vs. no CA
issue).

Best regards,
Pasi

---

From: Jon Callas <[email-masked]>
Date: Thu, 7 Aug 2008 14:24:43 -0700

> (BTW, to me, RSA vs. DSA seems totally orthogonal to CA vs. no CA

Require.

What consenting endpoints do in the privacy of their own SA is no  
concern of ours. :)

There's no reason you can't any key-centric system and send the keys  
off to a CA to be certified; similarly there's no reason you can't pry  
the key out of a certificate and use it in a key-centric system.

(As an aside, DKIM is another key-centric system that defines RSA  
only, but similarly does not require certificates.)

	Jon

---

From: Martin Schütte <[email-masked]>
Date: Mon, 11 Aug 2008 14:49:23 +0200

> date, throw out the existing consensus and put in RSA and CAs?

I think we can agree not to have any notion of CAs in syslog-sign,
besides the simple fact that users of PKIX and OpenPGP keys might use 
one witout affecting syslog-sign.

But what would be necessary to include RSA and ECDSA? As far as I see we 
just had to assign two additional VERsion digits values for the 
Signature Scheme.

So I suggest for 4.2.1:
       Signature Scheme - 1 octet, where, in conjunction with Protocol
       Version 01, a value of "1" denotes OpenPGP DSA [RFC4880,
       FIPS 186-3], a value of "2" denotes RSA [RFC4880, FIPS 186-3],
       and a value of "3" denotes ECDSA [FIPS 186-3].

    The version, hash algorithm [...unchanged paragraph...] marks).
    For interoperability all implementations MUST support Version "0111"
    (DSA with SHA-1).

Updated references:
      [RFC4880]     Callas, J., Donnerhacke, L., Finney, H., D. Shaw,
                    and R. Thayer, "OpenPGP Message Format", RFC 4880,
                    November 2007.
      [FIPS 186-3]  Federal Information Processing
                    Standards Publication (FIPS PUB) 186-3,
                    Digital Signature Standard (DSS), (draft)
                    March 2006.

-- 
Martin

---

From: Jon Callas <[email-masked]>
Date: Mon, 11 Aug 2008 14:47:23 -0700

On Aug 11, 2008, at 5:49 AM, Martin Schütte wrote:

> besides the simple fact that users of PKIX and OpenPGP keys might  
> use one witout affecting syslog-sign.
>
>
> But what would be necessary to include RSA and ECDSA? As far as I  
> see we just had to assign two additional VERsion digits values for  
> the Signature Scheme.

I agree that it's not all that difficult to add it in, but the draft  
has gone this far with WG consensus that it is not needed. I don't  
think we can add it without pulling it out of last call and re-opening  
it up. I might be wrong, but nonetheless, Pasi Eronen asked the  
question of why it was DSA-only, and we answered. I don't believe we  
have to add in RSA. During last call, ADs ask a number of good, tough  
questions that don't require negating the WG consensus. And since the  
document in its present state is a product of WG consensus, we need a  
semblance of that to add in a major new feature like a new public key  
algorithm.

	Jon

---

From: "Richard Graveman" <[email-masked]>
Date: Mon, 11 Aug 2008 20:21:55 -0400

I agree with Jon on all counts. A good reason for the choice exists,
the draft has been stable for years, no security issue is raised, keep
it simple, and who wants to start discussing which of the three are
MUST, SHOULD, or MAY?

Richard Graveman

On Mon, Aug 11, 2008 at 5:47 PM, Jon Callas <[email-masked]> wrote:
>> besides the simple fact that users of PKIX and OpenPGP keys might use one
>> witout affecting syslog-sign.
>>
>>
>> just had to assign two additional VERsion digits values for the Signature
>> Scheme.
>
> I agree that it's not all that difficult to add it in, but the draft has
> gone this far with WG consensus that it is not needed. I don't think we can
> add it without pulling it out of last call and re-opening it up. I might be
> wrong, but nonetheless, Pasi Eronen asked the question of why it was
> DSA-only, and we answered. I don't believe we have to add in RSA. During
> last call, ADs ask a number of good, tough questions that don't require
> negating the WG consensus. And since the document in its present state is a
> product of WG consensus, we need a semblance of that to add in a major new
> feature like a new public key algorithm.
>
>        Jon
>
>