Subject: [Cfrg] BCP on crypto algorithms?

From: Hal Murray <[email-masked]>
Date: Tue, 29 Mar 2016 15:23:47 -0700

I'm looking for something like a Best Current Practices (BCP) document that 
covers crypto.  A non-RFC source is OK as long as it's generally trusted.  
Preferably a source that is stable and updated occasionally.  Does such a 
document exist?

The context is NTP (Network Time Protocol).  It currently has a simple shared 
key authentication mechanism that uses MD5 or SHA1.  It's probably time to 
update that.  What should we use?

There is also work in progress on a new scheme.  It would be nice to start 
with reasonable algorithms and even better if we could include a pointer to 
something that would be kept up to date.

Apologies for the clutter if this is the wrong group.

-- 
These are my opinions.  I hate spam.

---

From: Peter Gutmann <[email-masked]>
Date: Wed, 30 Mar 2016 11:20:05 +0000

>Preferably a source that is stable and updated occasionally.  Does such a

Yes and no.  While there's general agreement on what crypto you shouldn't use
(single DES, ECB mode, MD5, etc), when it comes to what crypto to use you end
up in a twisty maze of personal opinions, all different.  Ask ten crypto
people and you'll get fifteen different opinions on what might constitute BCP.
I don't know of any obvious solution to this problem, you could perhaps find
something from a source that's acceptable to your target audience and declare
that to be BCP.

>update that.  What should we use?

You're going to need to constrain things much, much more than that if you want
a useful answer.  The above is sort of like going to an architect and saying
"we want a building, we have infinite funding and time available, be
creative".

Peter.

---

From: "Paterson, Kenny" <[email-masked]>
Date: Wed, 30 Mar 2016 11:55:24 +0000

Dear Hal,

Peter is correct in his assessment - your question is probably a bit broad.

These ENISA reports on algorithms and protocols might help you get started
though:

https://www.enisa.europa.eu/activities/identity-and-trust/library/deliverab
les/study-on-cryptographic-protocols

https://www.enisa.europa.eu/activities/identity-and-trust/library/deliverab
les/algorithms-key-size-and-parameters-report-2014

Although published in 2014, the two documents remain fairly up-to-date in
most aspects. Unfortunately, I don't think they're being updated any
longer.

Cheers

Kenny

On 30/03/2016 12:20, "Cfrg on behalf of Peter Gutmann"
<[email-masked] on behalf of [email-masked]> wrote:

>_______________________________________________
>Cfrg mailing list
>[email-masked]
>https://www.irtf.org/mailman/listinfo/cfrg