Subject: [CGA-EXT] 2 questions regarding the refered pki in SEND&CGA

From: Sean Shuo Shen <[email-masked]>
Date: Fri, 21 Mar 2008 10:14:22 +0800

Hi,
I get two questions while looking deeply into the referred PKI standards in
SEND&CGA:
1. 
Section 5.2(Digital Signature) of SEND refer to [13], which is:
[13]  RSA Laboratories, "RSA Encryption Standard, Version 2.1", PKCS 1,
November 2002.
The only version 2.1 of PKCS1 I found on RSA webpage is dated as "June 14th,
2002". This confused me a little and might also confuse others. Check the
link:
http://www.rsa.com/rsalabs/node.asp?id=2125 

2. 
In section 3 of CGA, the public key field description include: "When RSA is
used, the algorithm identifier MUST be rsaEncryption, which is
1.2.840.113549.1.1.1,", This number can be checked in section 2.2.1 of
rfc3279.
Actually, in rfc3279, this identifier (1.2.840.113549.1.1.1) covered 3
algorithms: md2WithRSAEncryption, md5WithRSAEncryption and
sha-1WithRSAEncryption. 
We know CGA use SHA1 as the algorithm to generated hash2 and hash1, it's
important in a security protocol that different algorithms should be on the
same level of strength (at least all above the desired level). Not to
mention that md2 and md5 have been recommended not to use for a while. Thus
the algorithm should be more specific to be sha-1WithRSAEncryption, which
has the identifier as 1.2.840.113549.1.1.1.5

Sean

_______________________________________________
CGA-EXT mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/cga-ext