Subject: [Spasm] Fwd: New Version Notification for draft-turner-lamps-adding-sha3-to-pkix-00.txt

From: Sean Turner <[email-masked]>
Date: Mon, 6 Mar 2017 10:58:57 -0500

I took a first swing at the SHA-3 draft:

> Begin forwarded message:
> 
> From: [email-masked]
> Subject: New Version Notification for draft-turner-lamps-adding-sha3-to-pkix-00.txt
> Date: March 6, 2017 at 10:53:51 AM EST
> To: "Sean Turner" <[email-masked]>
> 
> 
> A new version of I-D, draft-turner-lamps-adding-sha3-to-pkix-00.txt
> has been successfully submitted by Sean Turner and posted to the
> IETF repository.
> 
> Name:		draft-turner-lamps-adding-sha3-to-pkix
> Revision:	00
> Title:		SHA-3 Related Algorithms and Identifiers for PKIX
> Document date:	2017-03-06
> Group:		Individual Submission
> Pages:		11
> URL:            https://www.ietf.org/internet-drafts/draft-turner-lamps-adding-sha3-to-pkix-00.txt
> Status:         https://datatracker.ietf.org/doc/draft-turner-lamps-adding-sha3-to-pkix/
> Htmlized:       https://tools.ietf.org/html/draft-turner-lamps-adding-sha3-to-pkix-00
> 
> 
> Abstract:
>   This document describes the conventions for using the SHA-3 family of
>   hash functions in the Internet X.509 PKI as one-way hash functions
>   and with the ECDSA signature algorithm; the conventions for the
>   associated ECDSA subject public keys are also described.  Digital
>   signatures are used to sign certificates and CRLs (Certificate
>   Revocation Lists).
> 

The gh repo can be found at:
https://github.com/seanturner/draft-turner-lamps-adding-sha3-to-pkix

Couple of questions for -01:

1. Do we want to add SHA3-224 and the associated signature algorithms?  I’m sure we could do it for completeness but does anybody really need these?

2. Do we need to add DSA? Again we could do this for completeness, but is there anybody who issues DSA certificates now that’s actually going to switch to SHA-3 in the future?  And would they say so on list?

3. Do we really need RSASSA-PKCS1-v1.5?  RSA suggested moving towards RSASSA-PSS over a decade ago and we’re actually considering specifying it RSASSA-PKCS1-v1.5 with SHA-3?

Notes:

1. The HMAC algorithms don’t really fit in this draft.
2. I mentioned but purposely omit the expandable-output functions.
3. There’s OIDs at http://csrc.nist.gov/groups/ST/crypto_apps_infra/csor/algorithms.html <http://csrc.nist.gov/groups/ST/crypto_apps_infra/csor/algorithms.html> but the only ASN.1 module is for the AES-related algorithms so I added ASN.1 modules (’88 and ’12/’15) but I’d use the OIDs from NIST page.

Comments obviously welcome.

spt

---

From: Russ Housley <[email-masked]>
Date: Mon, 6 Mar 2017 11:07:23 -0500

Thanks Sean.

We cannot adopt this in the working group until the IESG approves a charter update.  However, I think we can talk about the document in preparation for the updated charter.

> https://github.com/seanturner/draft-turner-lamps-adding-sha3-to-pkix <https://github.com/seanturner/draft-turner-lamps-adding-sha3-to-pkix>
> 

I do not mind them being there for completeness, but I have not seen any use of SHA-224.

> 2. Do we need to add DSA? Again we could do this for completeness, but is there anybody who issues DSA certificates now that’s actually going to switch to SHA-3 in the future?  And would they say s…

I am aware of some systems that used DSA years ago, but I am not aware of anything recent.  If anyone know of a system that might use DSA with SHA3, please speak up.

> 3. Do we really need RSASSA-PKCS1-v1.5?  RSA suggested moving towards RSASSA-PSS over a decade ago and we’re actually considering specifying it RSASSA-PKCS1-v1.5 with SHA-3?

These are a lot of systems that continue to use RSASSA-PKCS1-v1.5.  I think these identifiers are needed.

That said, does anyone know of a system that would likely use RSASSA-PSS with SHA3?

Russ

---

From: Nikos Mavrogiannopoulos <[email-masked]>
Date: Tue, 07 Mar 2017 09:02:00 +0100

On Mon, 2017-03-06 at 10:58 -0500, Sean Turner wrote:
> 1. Do we want to add SHA3-224 and the associated signature
> algorithms?  I’m sure we could do it for completeness but does
> anybody really need these?

Most likely not.

> 2. Do we need to add DSA? Again we could do this for completeness,
> but is there anybody who issues DSA certificates now that’s actually
> going to switch to SHA-3 in the future?  And would they say so on
> list?

I think DSA is being slowly dropped from any applications and protocols
that used to support it and there is little interest even following up
and bringing documents up to date with DSA2.

> 3. Do we really need RSASSA-PKCS1-v1.5?  RSA suggested moving towards
> RSASSA-PSS over a decade ago and we’re actually considering
> specifying it RSASSA-PKCS1-v1.5 with SHA-3?

Yes please. RSASSA-PSS has close to none deployment/usage at this
point, and very few CAs can issue certificates with that OID. That may
change when TLS1.3 is out, but that's yet to be seen. 

regards,
Nikos