Subject: Re: draft-gaonkar-radext-erp-attrs-03

From: <[email-masked]>
Date: Thu, 13 Mar 2008 16:20:27 -0700

> There is a desire to use NIST-approved key-wrap
> algorithms for wrapping keys, and those algorithms are inappropriate for
> general-purpose data encryption.

I'm not sure why this is a problem.   The encrypted attribute
container can include an algorithm field, so that it would be possible to 
encrypt one bag of attributes (not keys) with one algorithm, while using
a keywrap algorithm for another bag (which represent keys).

A (perhaps silly) question:

* Are general encryption algorithms suitable for use in encrypting keys? 
The Diameter EAP application has always assumed that they were. 

* Is there a pointer to a the limitations of keywrap algorithms? 

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://psg.com/lists/radiusext/>

---

From: "David B. Nelson" <[email-masked]>
Date: Thu, 13 Mar 2008 19:33:48 -0400

> a keywrap algorithm for another bag (which represent keys).

In our hallway discussion of this afternoon, Joe Salowey indicated that his
preference is to make it harder for an implementer to make the mistake of
using the incorrect class of cipher-suite, e.g. to protect general data with
a key-wrap (too weak) or protect a key with a non-NIST-approved algorithm.
Otherwise, we could do as you suggest.  I had made the same point during our
discussion.
 
> * Are general encryption algorithms suitable for use in encrypting keys?

There are really two questions -- (a) "is the algorithm and mode suitably
strong?" and (b) "is it NIST-approved?"  The former is easier to satisfy.

---

From: Stefan Winter <[email-masked]>
Date: Thu, 20 Mar 2008 16:27:26 +0100

Hi,

> strong?" and (b) "is it NIST-approved?"  The former is easier to satisfy.

could you give a short reminder on why this particular approval (NIST) is of 
crucial importance?

Thanks,

Stefan

-- 
Stefan WINTER

Stiftung RESTENA - Réseau Téléinformatique de l'Education Nationale et de 
la Recherche
Ingenieur Forschung & Entwicklung

6, rue Richard Coudenhove-Kalergi
L-1359 Luxembourg
E-Mail: [email-masked]     Tel.:     +352 424409-1
http://www.restena.lu                Fax:      +352 422473

---

From: "David B. Nelson" <[email-masked]>
Date: Thu, 20 Mar 2008 12:38:36 -0400

Stefan Winter writes....

> could you give a short reminder on why this particular approval (NIST)
> is of crucial importance?

I invite others who are more directly involved to add their thoughts, but as
I understand it, use of NIST certified cryptographic algorithms and modes is
a prerequisite to obtaining FIPS 140-2 certification, which is a requirement
for selling certain networking products to certain US Federal Government
departments.

There may be collateral benefit in marketing such products to
security-sensitive private sector markets, such as banking, finance or
healthcare.

---

From: "Glen Zorn" <[email-masked]>
Date: Thu, 20 Mar 2008 13:44:49 -0400

[email-masked] <> scribbled on Thursday, March 20, 2008
12:39 PM:

> Stefan Winter writes....
> 
>> could you give a short reminder on why this particular approval
>> (NIST) is of crucial importance?
> 
> I invite others who are more directly involved to add their
> thoughts, but as I understand it, use of NIST certified
> cryptographic algorithms and modes is a prerequisite to
> obtaining FIPS 140-2 certification, which is a requirement for
> selling certain networking products to certain US Federal Government
> departments. 
> 
> security-sensitive private sector markets, such as banking, finance
> or healthcare. 

And other governmental entities...

> 
> 
> 
> --
> to unsubscribe send a message to
> [email-masked] with the word 'unsubscribe' in
> a single line as the message text body.