Subject: [lamps] RSA Key Length in draft-ietf-lamps-cmp-updates

From: Russ Housley <[email-masked]>
Date: Fri, 30 Jul 2021 11:29:34 -0400

draft-ietf-lamps-cmp-updates defines id-regCtrl-rsaKeyLen as:

      RsaKeyLenCtrl ::= INTEGER

At a minimum, I think we need to make this a positive integer.

I see that other groups are pushing for bigger minimum key sizes for RSA and D-H.

What do others think?

Russ

---

From: "Salz, Rich" <[email-masked]>
Date: Fri, 30 Jul 2021 15:32:25 +0000

>    I see that other groups are pushing for bigger minimum key sizes for RSA and D-H.

If we can avoid saying anything about this, that would probably be easiest.

---

From: "Brockhaus, Hendrik" <[email-masked]>
Date: Fri, 30 Jul 2021 16:09:10 +0000

Russ, Rich

> Von: Spasm <[email-masked]> Im Auftrag von Salz, Rich
> 

Agreed. I do only know the type INTEGER, for example in PollRepContent where the checkAfter time (a time in seconds) also needs to be positive.
Should we use a different type here, or only express it in the comment?

> If we can avoid saying anything about this, that would probably be easiest.

In CMP Updates we could leave it open and in the Lightweight CMP Profile, we could specify it more concretely.

Hendrik

---

From: Russ Housley <[email-masked]>
Date: Fri, 30 Jul 2021 12:15:20 -0400

Hendrik:

This is all positive integers:

   RsaKeyLenCtrl ::= INTEGER(1..MAX)

Of course, a one bit RSA key is silly.

Russ

> On Jul 30, 2021, at 12:09 PM, Brockhaus, Hendrik <[email-masked]> wrote:
> 
> Russ, Rich
>

---

From: "Brockhaus, Hendrik" <[email-masked]>
Date: Fri, 30 Jul 2021 16:18:15 +0000

Russ

> Von: Russ Housley <[email-masked]>
> 
> 

Dose this also works for the 1988 ASN.1 module?

Hendrik

---

From: Russ Housley <[email-masked]>
Date: Fri, 30 Jul 2021 12:18:42 -0400

Yes, this works in both.

> On Jul 30, 2021, at 12:18 PM, Brockhaus, Hendrik <[email-masked]> wrote:
> 
> Russ
>

---

From: "Salz, Rich" <[email-masked]>
Date: Fri, 30 Jul 2021 16:21:22 +0000

>   Of course, a one bit RSA key is silly.

Interesting philosophical question, I suppose. Is 1 a prime?

---

From: Dmitry Belyavsky <[email-masked]>
Date: Fri, 30 Jul 2021 18:23:41 +0200

> Interesting philosophical question, I suppose. Is 1 a prime?

No. If it is considered, it will destroy the Fundamental theorem of
arithmetic

-- 
SY, Dmitry Belyavsky

---

From: David von Oheimb <[email-masked]>
Date: Fri, 30 Jul 2021 22:17:44 +0200

> I see that other groups are pushing for bigger minimum key sizes for RSA and D-H.

I don't think it's worth the hassle making restrictions on key lengths 
at this point.

> Interesting philosophical question, I suppose. Is 1 a prime?

None of the usual key lengths (including RSA modulus size) is a prime.

> If we can avoid saying anything about this, that would probably be easiest.

I agree here.

In my view,

is entirely sufficient for the syntax of RSA key lengths.

It is understood that only sensible values should be used there,
and I see little point in trying to force users to do this at syntactic 
level.

     David