Subject: [KEYPROV] The Keywrap algorithms issue

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Wed, 4 Feb 2009 08:23:54 -0800

Just spoke to Russ, his suggestion is:
 
1) Write spec so that it is algorithm independent.
2) Do not mandate use of any particular algorithm
3) Specify the three recommended algorithms
 
The rationale for this comes from experience of PKIX, SMIME and elsewhere. Note that PKIX is broken into 3280 certs and 3279 algorithms. There are no mandatory to implements. In fact this is now the norm for IETF, the main exception being TLS.
 
I asked if we should mandate implementation of one particular algorithm for Interoperability testing. It turns out that this has not proved to be an issue. At any given point in time people implement whatever the preferred algorithm suite of the day is plus whatever the legacy infrastructure is using.
 
What is critical here is that KEYPROV (Alg-X) interops with KEYPROV (Alg-X) for any given instantiation of Alg-X.

---

From: "Hannes Tschofenig" <[email-masked]>
Date: Tue, 10 Feb 2009 14:52:41 +0200

That's an interesting view. It wasn't quite the response I have expected. 
 
Just to have a look at the outcome, what would we write into PSKC?

________________________________

	From: [email-masked] [mailto:[email-masked]] On
Behalf Of Hallam-Baker, Phillip
	Sent: 04 February, 2009 18:24
	To: [email-masked]
	Subject: [KEYPROV] The Keywrap algorithms issue

	 
	The rationale for this comes from experience of PKIX, SMIME and
elsewhere. Note that PKIX is broken into 3280 certs and 3279 algorithms.
There are no mandatory to implements. In fact this is now the norm for IETF,
the main exception being TLS.
	 
	I asked if we should mandate implementation of one particular
algorithm for Interoperability testing. It turns out that this has not
proved to be an issue. At any given point in time people implement whatever
the preferred algorithm suite of the day is plus whatever the legacy
infrastructure is using.
	 
	What is critical here is that KEYPROV (Alg-X) interops with KEYPROV
(Alg-X) for any given instantiation of Alg-X.

---

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Tue, 10 Feb 2009 06:06:03 -0800

As he said, put the algorithms in a separate doc, describe the currently recommended set.
 
No required algorithms.

From: Hannes Tschofenig [mailto:[email-masked]]
Sent: Tue 2/10/2009 7:52 AM
To: Hallam-Baker, Phillip; [email-masked]
Subject: RE: [KEYPROV] The Keywrap algorithms issue

       
       As it sad,

---

From: "Hannes Tschofenig" <[email-masked]>
Date: Tue, 10 Feb 2009 16:32:31 +0200

Hi Phillip, 

the algorithms are currently in separate documents. 
 
Section 6.1, for example, says: 
 
"
   Systems implementing PSKC MUST support AES128-CBC (with the URI of
   http://www.w3.org/2001/04/xmlenc#aes128-cbc).  An example list of
   optionally-to-implement encryption algorithms can be found below:

 Algorithm      | Uniform Resource Locator (URL)
 ---------------+-------------------------------------------------------
 AES192-CBC     | http://www.w3.org/2001/04/xmlenc#aes192-cbc
 AES256-CBC     | http://www.w3.org/2001/04/xmlenc#aes256-cbc
 TripleDES-CBC  | http://www.w3.org/2001/04/xmlenc#tripledes-cbc
 Camellia128    | http://www.w3.org/2001/04/xmldsig-more#camellia128
 Camellia192    | http://www.w3.org/2001/04/xmldsig-more#camellia192
 Camellia256    | http://www.w3.org/2001/04/xmldsig-more#camellia256
 KW-AES128      | http://www.w3.org/2001/04/xmlenc#kw-aes128
 KW-AES192      | http://www.w3.org/2001/04/xmlenc#kw-aes192
 KW-AES256      | http://www.w3.org/2001/04/xmlenc#kw-aes256
 KW-TripleDES   | http://www.w3.org/2001/04/xmlenc#kw-tripledes
 KW-Camellia128 | http://www.w3.org/2001/04/xmldsig-more#kw-camellia128
 KW-Camellia192 | http://www.w3.org/2001/04/xmldsig-more#kw-camellia192
 KW-Camellia256 | http://www.w3.org/2001/04/xmldsig-more#kw-camellia256

   When algorithms without integrity checks are used, such as AES12-CBC,
   a keyed MAC value using the same key as the key encryption key MUST
   be placed in the <ValueMAC> element of the <Data> element.  In this
   case the MAC algorithm type MUST be set in the <MACAlgorithm> element
   of the <KeyContainer> element.  Implementations of PSKC MUST support
   HMAC-SHA1 (with the URI of
   http://www.w3.org/2000/09/xmldsig#hmac-sha1) as the mandatory-to-
   implement MAC algorithm.  An example list of optionally-to-implement
   MAC algorithms can be found below:

   Algorithm      | Uniform Resource Locator (URL)
   ---------------+-----------------------------------------------------
   HMAC-SHA256    | http://www.w3.org/2001/04/xmldsig-more#hmac-sha256
   HMAC-SHA384    | http://www.w3.org/2001/04/xmldsig-more#hmac-sha384
   HMAC-SHA512    | http://www.w3.org/2001/04/xmldsig-more#hmac-sha512
"

Instead of mandating a single one we would recommend implementing more than
one and talk a bit about the environment where a specific choice would be
relevant. 

Ciao
Hannes

	From: Hallam-Baker, Phillip [mailto:[email-masked]] 
	Sent: 10 February, 2009 16:06
	To: Hannes Tschofenig; [email-masked]
	Subject: RE: [KEYPROV] The Keywrap algorithms issue

	As he said, put the algorithms in a separate doc, describe the
currently recommended set.
	 
	No required algorithms.

	That's an interesting view. It wasn't quite the response I have
expected.

	
	
	        From: [email-masked]
[mailto:[email-masked]] On
	Behalf Of Hallam-Baker, Phillip
	        Sent: 04 February, 2009 18:24
	        To: [email-masked]
	        Subject: [KEYPROV] The Keywrap algorithms issue
	       
	       As it sad, 

	        The rationale for this comes from experience of PKIX, SMIME
and
	elsewhere. Note that PKIX is broken into 3280 certs and 3279
algorithms.
	There are no mandatory to implements. In fact this is now the norm
for IETF,
	the main exception being TLS.
	        
	        I asked if we should mandate implementation of one
particular
	algorithm for Interoperability testing. It turns out that this has
not
	proved to be an issue. At any given point in time people implement
whatever
	the preferred algorithm suite of the day is plus whatever the legacy
	infrastructure is using.
	        
	        What is critical here is that KEYPROV (Alg-X) interops with
KEYPROV
	(Alg-X) for any given instantiation of Alg-X.

---

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Tue, 10 Feb 2009 07:51:12 -0800

I know, so that would mean that all we need to do is to remove the must and specify the three recommendations. I guess it would not hurt to give the specific applications where particular algorithms are recommended.

From: Hannes Tschofenig [mailto:[email-masked]]
Sent: Tue 2/10/2009 9:32 AM
To: Hallam-Baker, Phillip; [email-masked]
Subject: RE: [KEYPROV] The Keywrap algorithms issue

Hi Phillip,

"

Ciao
Hannes

        
        No required algorithms.

       

       
              
               As it sad,