Subject: Algorithm Naming

From: "Raif S. Naffah" <[email-masked]>
Date: Mon, 14 Jan 2002 09:36:05 +1100

We are faced with the problem of referencing algorithm names in
our specification (SRP SASL mechanism).  Related to algorithm
naming, http://www.ietf.org/ID-nits.html states:

   Variant Algorithm Definitions

   If you specify multiple algorithms for a particular function:
   For example, if there are multiple compression algorithms,
   encryption algorithms, representation formats, etc., consider

     * A robust way to enumerate these, preferably with space
     for future assignments by the Internet Assigned Number
     Authority

     * Consider re-using an existing IANA registry instead of
     creating a new one, since this leads to less confusion
     between different registries that have similar items.

Current IANA registries related to algorithm naming include:

   "Magic Numbers" for ISAKMP Protocol
   http://www.iana.org/assignments/isakmp-registry

   ONE TIME PASSWORD PARAMETERS
   http://www.iana.org/assignments/otp-parameters

   TELNET OPTIONS
   http://www.iana.org/assignments/telnet-options

All of these are references for a certain specification and/or
protocol.  None of them provide a central reference that can
be used by current or future IETF drafts/RFCs to unambiguously
reference algorithms/primitives used within their
specifications.

Rather than create a new IANA registry solely for our
specification, we propose that a new IANA registry be created
to store security-related naming information that can be
referenced by multiple specifications.  This registry would
hold information such as the names of message digest
algorithms, integrity protection algorithms, ciphers, cipher
modes of operations, key negotiation algorithms etc. (the
name), as well as the reference to some published
specifications of their design (the specification).

The initiation of this process may be through an informational
RFC that (a) describes the problem in more details, (b) gives
an initial list of algorithm names, and (c) guidelines for
registring more names with IANA.

Keith Burdis and Raif S. Naffah

---

From: Stephen Kent <[email-masked]>
Date: Tue, 15 Jan 2002 00:05:30 -0500

A number of algorithms/modes are identified by OIDs, which are issued 
by various organizations under the overall ITU umbrella. I think IANA 
manages a tree arc for this purpose and we make use of it in several 
WGs already, e.g., S/MIME and PKIX. These WGs also make use of OIDs 
issued by other organizations (e.g., IEEE, RSA, NIST, DoD) who have 
arcs in the tree, to avoid duplication.

Steve

---

From: [email-masked]
Date: Tue, 15 Jan 2002 13:34:55 +0200

> arcs in the tree, to avoid duplication.

This is an interesting idea. Are there unique names associated with these OIDs?

While OIDs themselves are unique, we don't want to have to use:

  integrity=1.3.6.1.5.5.8.1.1

We'd rather use:

  integrity=HMAC-MD5

> Steve

  - Keith

---

From: "Raif S. Naffah" <[email-masked]>
Date: Wed, 16 Jan 2002 09:49:05 +1100

>   integrity=1.3.6.1.5.5.8.1.1

furthermore, OID-to-name associations lack the other aspect of the proposed 
registry: the specification of  the algorithm itself; i.e. what (exactly) 
is referred to by the name.

cheers;
rsn

---

From: Stephen Kent <[email-masked]>
Date: Tue, 15 Jan 2002 12:11:17 -0500

>   integrity=1.3.6.1.5.5.8.1.1

There is a name associated with each registered algorithm, but it is 
not a requirement that the name be unique. also, in many instances, 
the form of the name will need to be more complex than your example, 
because of additional parameters of the algorithms. For example, 
HMAC-MD5 doesn't say whether the full 128-bit output is employed, or 
whether a truncated output is used, as in the case of current IPsec 
use in ESP and AH. I may have missed the usage context details that 
make use of OIDs impractical; could you restate the requirements re 
the form of the "name?"

Steve

---

From: Stephen Kent <[email-masked]>
Date: Tue, 15 Jan 2002 00:05:30 -0500

Steve

---

From: [email-masked]
Date: Tue, 15 Jan 2002 13:34:55 +0200

We'd rather use:

  integrity=HMAC-MD5

  - Keith

---

From: "Raif S. Naffah" <[email-masked]>
Date: Wed, 16 Jan 2002 09:49:05 +1100

cheers;
rsn

---

From: Stephen Kent <[email-masked]>
Date: Tue, 15 Jan 2002 12:11:17 -0500

Steve