Subject: [MSEC] Question about your comments from IETF-78

From: "Sheela Rowles (sheela)" <[email-masked]>
Date: Thu, 9 Sep 2010 08:25:31 -0700

Hi David,

I've been looking over the minutes from the proceedings and need some
clarification on the below comments:

"

David: SIG ALG RSA, it will be nice to use with SHA256?

Brain: MUST be more tightly coupled.

Tim: Pairing  both MUSTs looks good.

David: I think the same.

"

Isn't it sufficient to specify the MUST requirement as is?

                Requirement   KEK Signature Hash Algorithm (notes)

                -----------   ------------------------------------

                MUST          SIG_HASH_SHA256

                SHOULD        SIG_HASH_SHA1 (2)

                SHOULD NOT    SIG_HASH_MD5 (3)

                Requirement   KEK Signature Algorithm (notes)

                -----------   -------------------------------

                MUST          SIG_ALG_RSA with 2048-bit keys

Can you please clarify?  

Thanks,

Sheela