Subject: [Uta] rfc7525bis and CNSA

From: Peter Saint-Andre <[email-masked]>
Date: Fri, 23 Jul 2021 12:32:31 -0600

The authors of rfc7525bis have noticed that the Commercial National
Security Algorithm Suite (CNSA) contains some strong recommendations
regarding topics of interest, including 3072-bit RSA, 3072-bit DHE, and
ECDHE with secp384r1. These recommendations and others are summarized in
draft-cooley-cnsa-dtls-tls-profile (currently in the RFC Editor queue
via the Independent Submissions stream). We are wondering if the WG
thinks it makes sense to adopt some of these recommendations and
informatively reference draft-cooley-cnsa-dtls-tls-profile from rfc7525bis.

Thanks.

Peter

---

From: "Salz, Rich" <[email-masked]>
Date: Fri, 23 Jul 2021 18:46:08 +0000

> We are wondering if the WG

I strongly support this.

---

From: Stephen Farrell <[email-masked]>
Date: Fri, 23 Jul 2021 20:36:43 +0100

Hiya,

> informatively reference draft-cooley-cnsa-dtls-tls-profile from rfc7525bis.

If the rationale for each such change is explicitly provided
and discussed then I'd be ok with adopting such changes. If
not, then I'd be against.

I have two reasons:

- ISTM one could read that draft as just being a general
"turn it up a notch" which may be reasonable but I've also
heard that once any potential quantum attack is feasible
then 2048->3072 RSA won't really help (for long). So I'm not
sure we should encourage people to make such changes - we
may be better off trying to direct energies into PQC once
the time is right (which it's not yet IMO).

- With all due respect to the author, (whom I do respect),
in the light of dual-ec, I don't think unquestioningly
accepting advice from NSA without an explanation of the
rationale is an acceptable plan, no matter how sane the
advice may appear.

Cheers,
S.

Cheers,
S.

> 
> Thanks.
> 
> Peter
> 
> 
> 
> 
> 
> 
> _______________________________________________
> Uta mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/uta
>

---

From: Ryan Sleevi <[email-masked]>
Date: Fri, 23 Jul 2021 16:56:11 -0400

> not, then I'd be against.

The current draft just lists the rationale as "because CNSA says so" ( re:
https://www.cnss.gov/CNSS/issuances/Policies.cfm ).

> the time is right (which it's not yet IMO).

Agreed; namely, that these do not appear appropriate nor relevant for RFC
7525bis as presently stated and justified, and do not support such
integration.

---

From: "Martin Thomson" <[email-masked]>
Date: Mon, 26 Jul 2021 10:44:18 +1000

On Sat, Jul 24, 2021, at 04:32, Peter Saint-Andre wrote:
> ECDHE with secp384r1. 

I can see good reasons to move to slightly stronger constructions, but each recommendation needs justification, as others have noted.

If these recommendations were general industry practice already, that might be different.  But these levels are still relatively lightly used.

---

From: Peter Saint-Andre <[email-masked]>
Date: Mon, 26 Jul 2021 08:32:19 -0600

> I can see good reasons to move to slightly stronger constructions, but each recommendation needs justification, as others have noted.

Agreed.

> If these recommendations were general industry practice already, that might be different.  But these levels are still relatively lightly used.

True and that's a good reason not to include them now. 7525bis is
supposed to be a Best Current Practice in all three senses of the term.
We've always envisioned that this BCP would be updated periodically, say
every 5-10 years. With 7525 having been published in 2015 and 7525bis
likely to be published in 2022, we're roughly on schedule...

Peter