Subject: RE: Elliptic Curve Cryptography with PKIX

From: Robert Zuccherato <[email-masked]>
Date: Thu, 31 Aug 2006 10:24:25 -0400

It's been more than a few months now since Russ posted this message and I
haven't seen any further discussion on the topic.  As I said back in April,
my preference would be for PKIX to use the AlgorithmIdentifier in the
already approved X9.62 standard, since I don't think it is helpful to have
more than one AlgorithmIdentifier defined.

However, whatever we decide to do, I think that we should resolve the issue
and advance the draft as quickly as possible.  Developers of ECC
applications need to know which AlgorithmIdentifier to use.  

Does anyone else have any opinions on this topic?  When can we hope to see a
new ID?

	Robert Zuccherato.

> -----Original Message-----
> From: [email-masked] 
> [mailto:[email-masked]] On Behalf Of Russ Housley
> Sent: May 3, 2006 3:01 PM
> To: [email-masked]
> Subject: RE: Elliptic Curve Cryptography with PKIX
> 
> 
> 
> RFC 3280 does not provide as much guidance as I would like.  Section 
> 4.1.2.7 says the following about the  Subject Public Key Info field:
> 
>     This field is used to carry the public key and identify 
> the algorithm
>     with which the key is used (e.g., RSA, DSA, or 
> Diffie-Hellman).  The
>     algorithm is identified using the AlgorithmIdentifier structure
>     specified in section 4.1.1.2.  The object identifiers for the
>     supported algorithms and the methods for encoding the public key
>     materials (public key and parameters) are specified in [PKIXALGS].
> 
> Section 4.1.1.2 includes these words:
> 
>     The algorithm identifier is used to identify a cryptographic
>     algorithm.  The OBJECT IDENTIFIER component identifies 
> the algorithm
>     (such as DSA with SHA-1).  The contents of the optional parameters
>     field will vary according to the algorithm identified.
> 
> It does not really provide much guidance to developers of 
> AlgorithmIdentifiers.
> 
> I characterize the X9.62 approach as using the OBJECT IDENTIFIER to 
> name a class of elliptic curve algorithms, and then using a portion 
> of the parameters to list the members of that class that are 
> acceptable for the subject public key.
> 
> I am very interested to know how this fits with real implementations.
> 
> My suspicion is that implementation that support key agreement are 
> used to looking into the parameter to determine if the public key is 
> a member of the same group.  This is needed for static-static 
> Diffie-Hellman (in discrete log or elliptic curve).  This is also 
> needed for MQV (and KEA, if anyone cares anymore).
> 
> My suspicion is that digital signature validation does not anticipate 
> constraints in the public key algorithm parameters.  An underlying 
> crypto routine may need the parameters, but the signature is not 
> going to fail because of a constraint in the parameters, which could 
> happen in this proposed syntax.
> 
> I would greatly appreciate some insight from implementors.
> 
> Russ
>

---

From: Russ Housley <[email-masked]>
Date: Thu, 31 Aug 2006 10:47:41 -0400

My opinion has not changed.  I believe that we need to follow the
precedent set by RFC 4055.

In my opinion, this situation is a result of the ANSI X9 process not
allowing public review of their draft documents.  However, I do not
expect this policy to change.

Russ

At 10:24 AM 8/31/2006, Robert Zuccherato wrote:

It's been more than
a few months now since Russ posted this message and I haven't seen any
further discussion on the topic.  As I said back in April, my
preference would be for PKIX to use the AlgorithmIdentifier in the
already approved X9.62 standard, since I don't think it is helpful to
have more than one AlgorithmIdentifier defined.

However, whatever we decide to do, I think that we should
resolve the issue and advance the draft as quickly as possible.
Developers of ECC applications need to know which AlgorithmIdentifier to
use.

Does anyone else have any opinions on this topic?  When
can we hope to see a new ID?

Robert
Zuccherato.

[
mailto:[email-masked]] On Behalf Of Russ Housley

---

From: Daniel Brown <[email-masked]>
Date: Thu, 31 Aug 2006 12:09:15 -0400

Russ,

The X9.62 syntax follows the precedent set by 4055, in the sense that it 
identifies the algorithm for which the public key is to be used in the 
subject public key info field.

Section 3.3 of RFC 4055, item 3 in the list, clearly states that an 
signature validation implementation MUST check the parameters field of the 
subject public key info field algorithm identitifer when validating a 
signature, i.e. to see if it conforms used the correct hash, salt size 
specified in the cert.  This seems to contradict you final paragraph 
(copied below).

Dan Brown
(905) 501-3857
http://www.certicom.com

> ...

---

From: Russ Housley <[email-masked]>
Date: Thu, 31 Aug 2006 12:36:34 -0400

So, let's find out.  Can developers of software that validates
certificates and digital signatures tell us how the proposed parameter
syntax would impact their code?

Russ

At 12:09 PM 8/31/2006, Daniel Brown wrote:

Russ,

The X9.62 syntax follows the precedent set by 4055, in the
sense that it identifies the algorithm for which the public key is to be
used in the subject public key info field.

Section 3.3 of RFC 4055, item 3 in the list, clearly states
that an signature validation implementation MUST check the parameters
field of the subject public key info field algorithm identitifer when
validating a signature, i.e. to see if it conforms used the correct hash,
salt size specified in the cert.  This seems to contradict you final
paragraph (copied below).

Dan Brown

(905) 501-3857

http://www.certicom.com

[email-masked]

---

From: "Waterhouse, Richard" <[email-masked]>
Date: Thu, 31 Aug 2006 12:52:38 -0400

I liked the approach Mr Brown was proposing some time back though I don't know where it stands today. I need to, for example, restrict a key to be used with ECMQV. (I also need to, for example, inform the other end that the key is based on the NIST p384 curve.)

-----Original Message-----
From: [email-masked] [mailto:[email-masked]]On Behalf Of Russ Housley
Sent: Thursday, August 31, 2006 10:48 AM
To: Robert Zuccherato
Cc: 'Daniel Brown'; [email-masked]
Subject: RE: Elliptic Curve Cryptography with PKIX

My opinion has not changed.  I believe that we need to follow the precedent set by RFC 4055.

In my opinion, this situation is a result of the ANSI X9 process not allowing public review of their draft documents.  However, I do not expect this policy to change.

Russ

It's been more than a few months now since Russ posted this message and I haven't seen any further discussion on the topic.  As I said back in April, my preference would be for PKIX to use the AlgorithmIdentifier in the already approved X9.62 standard, since I don't think it is helpful to have more than one AlgorithmIdentifier defined.

However, whatever we decide to do, I think that we should resolve the issue and advance the draft as quickly as possible.  Developers of ECC applications need to know which AlgorithmIdentifier to use.  

Does anyone else have any opinions on this topic?  When can we hope to see a new ID? 

        Robert Zuccherato. 

> [  <mailto:[email-masked]> mailto:[email-masked]] On Behalf Of Russ Housley