From nobody Mon Jul 4 06:08:13 2016 Return-Path: X-Original-To: curdle@ietfa.amsl.com Delivered-To: curdle@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5F73A12D10F for ; Mon, 4 Jul 2016 06:08:12 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.7 X-Spam-Level: X-Spam-Status: No, score=-2.7 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id fR2ugBWg5P8N for ; Mon, 4 Jul 2016 06:08:11 -0700 (PDT) Received: from mail-wm0-x22d.google.com (mail-wm0-x22d.google.com [IPv6:2a00:1450:400c:c09::22d]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 9D6D012D11C for ; Mon, 4 Jul 2016 06:08:10 -0700 (PDT) Received: by mail-wm0-x22d.google.com with SMTP id 187so21592554wmz.1 for ; Mon, 04 Jul 2016 06:08:09 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=from:content-transfer-encoding:subject:message-id:date:to :mime-version; bh=RGxI1pFqstcLbw48FtcI3yelnz+ZHbLmZ9nKYhMT6ms=; b=DpfcdJcVMeZ7uFyjFDKA6V3DtSKHmnPyrd1rhfyzn7psMh2vSpBEfAoctnKT1i3rnB HgM5RhWL5YuTVFynM2oVx4qqEo5TdiT7cW+aUCIqnGnlvA+WxnSccsHutnbOG1j7/fMJ NHLRT59UmWZsW6zUKc5xSn8lPdtsUcItQRKO0hU1jENa0mhHh2umpyH5mJzsF/jQz/IO zyrmGGRZEK+H2bHnOpaSyDXVp6yq0oO5gdKMwpYn6zQuQMPrkATKtMkgHBoUAXPhkBRR j+wHvma2VOSG14yOI8X7OU5O+b1ljnBqQdil6zOJ02D/aMU+WvyiF1fbLBBKu4GMZeOw bvfA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:from:content-transfer-encoding:subject :message-id:date:to:mime-version; bh=RGxI1pFqstcLbw48FtcI3yelnz+ZHbLmZ9nKYhMT6ms=; b=iyTZHeMZRz8ioYm3Gsi5uag9g8xwsSWVfr2X+8VaaJNJCQ+uEXtCxsm9DNixGGrwSI p+spmNAjhqA7mVHYszVmlxDlygvAqhVDGTxxGLw5Jjuo2QZKJj0YpMcD86at3lK1FNUp OZmmR9aSS7P/vxFngV1viUJYHpnQ15z5IIeg/frHQl4UzEUD/JaXCXW5s3Vcv0+GWSUh Bz9DW1wG4xJqAoVRtAOMdfhjl/Im1WaqV6/ZmyoH66UIkWSKtd8jtFPHQcnl/bEunfa3 nRO3kJD2cefn9liFLQyFVQXaKqGK38rpQGM5C5/LMiXozFzfJiKY3S5XBbjHkeZnDuU/ VXyA== X-Gm-Message-State: ALyK8tImSqizfnTisZPccxdB/9Hy3IRyIRkJp8S04tbuL0EL0+YYRzDS6Ne3w1MbXd6dvw== X-Received: by 10.28.138.85 with SMTP id m82mr11265479wmd.88.1467637688325; Mon, 04 Jul 2016 06:08:08 -0700 (PDT) Received: from [172.24.249.249] (dyn32-131.checkpoint.com. [194.29.32.131]) by smtp.gmail.com with ESMTPSA id f193sm8483463wme.11.2016.07.04.06.08.06 for (version=TLS1 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Mon, 04 Jul 2016 06:08:07 -0700 (PDT) From: Yoav Nir Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Message-Id: Date: Mon, 4 Jul 2016 16:08:05 +0300 To: curdle@ietf.org Mime-Version: 1.0 (Mac OS X Mail 9.3 \(3124\)) X-Mailer: Apple Mail (2.3124) Archived-At: Subject: [Curdle] Question about EdDSA and IKEv2 X-BeenThere: curdle@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "List for discussion of potential new security area wg." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 04 Jul 2016 13:08:12 -0000 Hi. I have a question for this working group, but first a short = introduction. RFC 7427 describes how to introduce new digital signature algorithms = into IKEv2. The way it=E2=80=99s done is that the AUTH payload = concatenates a DER-encoded ASN.1 AlgorithmIdentifier object that = represents the signature algorithm and the signature itself. As examples, if we want to use sha256WithRSAEncryption, we encode the = OID 1.2.840.113549.1.1.11; If we want to encode ecdsa-with-sha256 we use = 1.2.840.10045.4.3.2, etc. The question is, what do we use for EdDSA? =20 Is it the 1.3.101.110 from draft-ietf-curdle-pkix-00? Is it 1.3.101.100 with parameter 1 from the same draft? I think it=E2=80=99s the former because the latter is for public key, = not signature. Am I understanding this correctly? Thanks Yoav From nobody Tue Jul 5 13:38:32 2016 Return-Path: X-Original-To: curdle@ietfa.amsl.com Delivered-To: curdle@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 02EE712D193; Tue, 5 Jul 2016 13:38:28 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -5.727 X-Spam-Level: X-Spam-Status: No, score=-5.727 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, RP_MATCHES_RCVD=-1.426, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cs.tcd.ie Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id FVgsA2tPnEIQ; Tue, 5 Jul 2016 13:38:25 -0700 (PDT) Received: from mercury.scss.tcd.ie (mercury.scss.tcd.ie [134.226.56.6]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 9768C12B03E; Tue, 5 Jul 2016 13:38:25 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by mercury.scss.tcd.ie (Postfix) with ESMTP id 19A44BE2C; Tue, 5 Jul 2016 21:38:21 +0100 (IST) X-Virus-Scanned: Debian amavisd-new at scss.tcd.ie Received: from mercury.scss.tcd.ie ([127.0.0.1]) by localhost (mercury.scss.tcd.ie [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id fxjDdf8BPwZ4; Tue, 5 Jul 2016 21:38:19 +0100 (IST) Received: from [10.87.48.75] (95-45-153-252-dynamic.agg2.phb.bdt-fng.eircom.net [95.45.153.252]) by mercury.scss.tcd.ie (Postfix) with ESMTPSA id 6CF63BE25; Tue, 5 Jul 2016 21:38:19 +0100 (IST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cs.tcd.ie; s=mail; t=1467751099; bh=oUDRiqnrllHapetF82sMealvbMH6RtsshJSWJkdqNGA=; h=To:From:Subject:Date:From; b=ZtEIfGW/+tTzpHwnCcs+mXmjCt+bO/N2zaUsF8n7kd0EEYs6PdBZI0f90lVAFfmlj unloDItb7BqhQxULy7Z6KbzP3mqwXn9S0TYsTrsYGLraGXRq0QxJ9wIkVh8e4PMPY2 PurTUNkFRYBS3PVaeR/Q52lh/3PJCLZwmTe5iFAE= To: "spasm@ietf.org" , "curdle@ietf.org" From: Stephen Farrell Openpgp: id=D66EA7906F0B897FB2E97D582F3C8736805F8DA2; url= Message-ID: <577C1ABB.4010809@cs.tcd.ie> Date: Tue, 5 Jul 2016 21:38:19 +0100 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:38.0) Gecko/20100101 Thunderbird/38.8.0 MIME-Version: 1.0 Content-Type: multipart/signed; protocol="application/pkcs7-signature"; micalg=sha-256; boundary="------------ms030806040400070007050306" Archived-At: Subject: [Curdle] move lamps meeting slot to Friday? X-BeenThere: curdle@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "List for discussion of potential new security area wg." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 05 Jul 2016 20:38:28 -0000 This is a cryptographically signed message in MIME format. --------------ms030806040400070007050306 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Hiya, We've gotten a request to move the lamps meeting slot back to Friday at 12:20 instead of curdle, which would then remain cancelled. (There is one overlapping issue that will be discussed in any case.) That would put lamps against: rtcweb, lwig, ntp, tictoc, bfd and aqm. The reason to ask for the move was that we have a contributor for whom the quic conflict is a problem. As of now, lamps is on Wednesday 10:00 against avtcore, mmusic, dhc, bmwg, netconf, rtgwg, ace, trans and quic. If this change would be good for you or a problem for you please let me know off or on list, ideally before Monday, July 11. Thanks, S. --------------ms030806040400070007050306 Content-Type: application/pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="smime.p7s" Content-Description: S/MIME Cryptographic Signature MIAGCSqGSIb3DQEHAqCAMIACAQExDzANBglghkgBZQMEAgEFADCABgkqhkiG9w0BBwEAAKCC CvIwggUIMIID8KADAgECAhBPzaE7pzYviUJyhmHTFBdnMA0GCSqGSIb3DQEBCwUAMHUxCzAJ BgNVBAYTAklMMRYwFAYDVQQKEw1TdGFydENvbSBMdGQuMSkwJwYDVQQLEyBTdGFydENvbSBD ZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTEjMCEGA1UEAxMaU3RhcnRDb20gQ2xhc3MgMSBDbGll bnQgQ0EwHhcNMTYwMjA5MDkyODE1WhcNMTcwMjA5MDkyODE1WjBOMSIwIAYDVQQDDBlzdGVw aGVuLmZhcnJlbGxAY3MudGNkLmllMSgwJgYJKoZIhvcNAQkBFhlzdGVwaGVuLmZhcnJlbGxA Y3MudGNkLmllMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAtuC0rYze/2JinSra C9F2RjGdQZjNALLcW9C3WKTwYII3wBslobmHuPEYE5JaGItmzuKnAW619R1rD/kfoNWC19N3 rBZ6UX9Cmb9D9exCwYIwVuSwjrCQWGxgCtNQTrwKzCCpI790GRiMTvxvO7UmzmBrCaBLiZW5 R0fBjK5Yn6hUhAzGBkNbkIEL28cLJqH0yVz7Kl92OlzrQqTPEts5m6cDnNdY/ADfeAX18c1r dxZqcAxhLotrCqgsVA4ilbQDMMXGTLlB5TP35HeWZuGBU7xu003rLcFLdOkD8xvpJoYZy9Kt 3oABXPS5yqtMK+XCNdqmMn+4mOtLwQSMmPCSiQIDAQABo4IBuTCCAbUwCwYDVR0PBAQDAgSw MB0GA1UdJQQWMBQGCCsGAQUFBwMCBggrBgEFBQcDBDAJBgNVHRMEAjAAMB0GA1UdDgQWBBQJ QhvwQ5Fl372Z6xqo6fdn8XejTTAfBgNVHSMEGDAWgBQkgWw5Yb5JD4+3G0YrySi1J0htaDBv BggrBgEFBQcBAQRjMGEwJAYIKwYBBQUHMAGGGGh0dHA6Ly9vY3NwLnN0YXJ0c3NsLmNvbTA5 BggrBgEFBQcwAoYtaHR0cDovL2FpYS5zdGFydHNzbC5jb20vY2VydHMvc2NhLmNsaWVudDEu Y3J0MDgGA1UdHwQxMC8wLaAroCmGJ2h0dHA6Ly9jcmwuc3RhcnRzc2wuY29tL3NjYS1jbGll bnQxLmNybDAkBgNVHREEHTAbgRlzdGVwaGVuLmZhcnJlbGxAY3MudGNkLmllMCMGA1UdEgQc MBqGGGh0dHA6Ly93d3cuc3RhcnRzc2wuY29tLzBGBgNVHSAEPzA9MDsGCysGAQQBgbU3AQIE MCwwKgYIKwYBBQUHAgEWHmh0dHA6Ly93d3cuc3RhcnRzc2wuY29tL3BvbGljeTANBgkqhkiG 9w0BAQsFAAOCAQEArzrSv2C8PlBBmGuiGrzm2Wma46/KHtXmZYS0bsd43pM66Pc/MsqPE0HD C1GzMFfwB6BfkJn8ijNSIhlgj898WzjvnpM/SO8KStjlB8719ig/xKISrOl5mX55XbFlQtX9 U6MrqRgbDIATxhD9IDr+ryvovDzChqgQj7mt2jYr4mdlRjsjod3H1VY6XglRmaaNGZfsCARM aE/TU5SXIiqauwt5KxNGYAY67QkOBs7O1FkSXpTk7+1MmzJMF4nP8QQ5n8vhVNseF+/Wm7ai 9mtnrkLbaznMsy/ULo/C2yuLUWTbZZbf4EKNmVdme6tUDgYkFjAFOblfA7W1fSPiQGagYzCC BeIwggPKoAMCAQICEGunin0K14jWUQr5WeTntOEwDQYJKoZIhvcNAQELBQAwfTELMAkGA1UE BhMCSUwxFjAUBgNVBAoTDVN0YXJ0Q29tIEx0ZC4xKzApBgNVBAsTIlNlY3VyZSBEaWdpdGFs IENlcnRpZmljYXRlIFNpZ25pbmcxKTAnBgNVBAMTIFN0YXJ0Q29tIENlcnRpZmljYXRpb24g QXV0aG9yaXR5MB4XDTE1MTIxNjAxMDAwNVoXDTMwMTIxNjAxMDAwNVowdTELMAkGA1UEBhMC SUwxFjAUBgNVBAoTDVN0YXJ0Q29tIEx0ZC4xKTAnBgNVBAsTIFN0YXJ0Q29tIENlcnRpZmlj YXRpb24gQXV0aG9yaXR5MSMwIQYDVQQDExpTdGFydENvbSBDbGFzcyAxIENsaWVudCBDQTCC ASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAL192vfDon2D9luC/dtbX64eG3XAtRmv mCSsu1d52DXsCR58zJQbCtB2/A5uFqNxWacpXGGtTCRk9dEDBlmixEd8QiLkUfvHpJX/xKnm VkS6Iye8wUbYzMsDzgnpazlPg19dnSqfhM+Cevdfa89VLnUztRr2cgmCfyO9Otrh7LJDPG+4 D8ZnAqDtVB8MKYJL6QgKyVhhaBc4y3bGWxKyXEtx7QIZZGxPwSkzK3WIN+VKNdkiwTubW5PI dopmykwvIjLPqbJK7yPwFZYekKE015OsW6FV+s4DIM8UlVS8pkIsoGGJtMuWjLL4tq2hYQuu N0jhrxK1ljz50hH23gA9cbMCAwEAAaOCAWQwggFgMA4GA1UdDwEB/wQEAwIBBjAdBgNVHSUE FjAUBggrBgEFBQcDAgYIKwYBBQUHAwQwEgYDVR0TAQH/BAgwBgEB/wIBADAyBgNVHR8EKzAp MCegJaAjhiFodHRwOi8vY3JsLnN0YXJ0c3NsLmNvbS9zZnNjYS5jcmwwZgYIKwYBBQUHAQEE WjBYMCQGCCsGAQUFBzABhhhodHRwOi8vb2NzcC5zdGFydHNzbC5jb20wMAYIKwYBBQUHMAKG JGh0dHA6Ly9haWEuc3RhcnRzc2wuY29tL2NlcnRzL2NhLmNydDAdBgNVHQ4EFgQUJIFsOWG+ SQ+PtxtGK8kotSdIbWgwHwYDVR0jBBgwFoAUTgvvGqRAW6UXaYcwyjRoQ9BBrvIwPwYDVR0g BDgwNjA0BgRVHSAAMCwwKgYIKwYBBQUHAgEWHmh0dHA6Ly93d3cuc3RhcnRzc2wuY29tL3Bv bGljeTANBgkqhkiG9w0BAQsFAAOCAgEAi+P3h+wBi4StDwECW5zhIycjBL008HACblIf26HY 0JdOruKbrWDsXUsiI0j/7Crft9S5oxvPiDtVqspBOB/y5uzSns1lZwh7sG96bYBZpcGzGxpF NjDmQbcM3yl3WFIRS4WhNrsOY14V7y2IrUGsvetsD+bjyOngCIVeC/GmsmtbuLOzJ606tEc9 uRbhjTu/b0x2Fo+/e7UkQvKzNeo7OMhijixaULyINBfCBJb+e29bLafgu6JqjOUJ9eXXj20p 6q/CW+uVrZiSW57+q5an2P2i7hP85jQJcy5j4HzA0rSiF3YPhKGAWUxKPMAVGgcYoXzWydOv Z3UDsTDTagXpRDIKQLZo02wrlxY6iMFqvlzsemVf1odhQJmi7Eh5TbxI40kDGcBOBHhwnaOu mZhLP+SWJQnjpLpSlUOj95uf1zo9oz9e0NgIJoz/tdfrBzez76xtDsK0KfUDHt1/q59BvDI7 RX6gVr0fQoCyMczNzCTcRXYHY0tq2J0oT+bsb6sH2b4WVWAiJKnSYaWDjdA70qHX4mq9MIjO /ZskmSY8wtAk24orAc0vwXgYanqNsBX5Yv4sN4Z9VyrwMdLcusP7HJgRdAGKpkR2I9U4zEsN JQJewM7S4Jalo1DyPrLpL2nTET8ZrSl5Utp1UeGp/2deoprGevfnxWB+vHNQiu85o6MxggPM MIIDyAIBATCBiTB1MQswCQYDVQQGEwJJTDEWMBQGA1UEChMNU3RhcnRDb20gTHRkLjEpMCcG A1UECxMgU3RhcnRDb20gQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkxIzAhBgNVBAMTGlN0YXJ0 Q29tIENsYXNzIDEgQ2xpZW50IENBAhBPzaE7pzYviUJyhmHTFBdnMA0GCWCGSAFlAwQCAQUA oIICEzAYBgkqhkiG9w0BCQMxCwYJKoZIhvcNAQcBMBwGCSqGSIb3DQEJBTEPFw0xNjA3MDUy MDM4MTlaMC8GCSqGSIb3DQEJBDEiBCCMBE/H/mSeCX3JJqR9n3WnOP/FkwrCPCeCeK0HoE0A EDBsBgkqhkiG9w0BCQ8xXzBdMAsGCWCGSAFlAwQBKjALBglghkgBZQMEAQIwCgYIKoZIhvcN AwcwDgYIKoZIhvcNAwICAgCAMA0GCCqGSIb3DQMCAgFAMAcGBSsOAwIHMA0GCCqGSIb3DQMC AgEoMIGaBgkrBgEEAYI3EAQxgYwwgYkwdTELMAkGA1UEBhMCSUwxFjAUBgNVBAoTDVN0YXJ0 Q29tIEx0ZC4xKTAnBgNVBAsTIFN0YXJ0Q29tIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MSMw IQYDVQQDExpTdGFydENvbSBDbGFzcyAxIENsaWVudCBDQQIQT82hO6c2L4lCcoZh0xQXZzCB nAYLKoZIhvcNAQkQAgsxgYyggYkwdTELMAkGA1UEBhMCSUwxFjAUBgNVBAoTDVN0YXJ0Q29t IEx0ZC4xKTAnBgNVBAsTIFN0YXJ0Q29tIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MSMwIQYD VQQDExpTdGFydENvbSBDbGFzcyAxIENsaWVudCBDQQIQT82hO6c2L4lCcoZh0xQXZzANBgkq hkiG9w0BAQEFAASCAQCews3QomCJfDlZIT7dbxyQTd1ZtpDWNbrJ3x3dBo4GKm3kVJ00309H Q9dDTSJDGpbO2XTLS0BbifG3oEve4vIqWa2mthMUwaA9YEg6N43aXJDHP0NQNREAbdBSy3FI B3G3ejvQsB8JS3VYfM4RlUBW+HSYk86pHGpFJgKt+e9jnallOEvDDD+pF7kOkaR69H8SdwOe 6xgOb6t1nlmh6Yz3Sn4DxQbf08NdI6moH0bZHW9frxTsVsEhY/lwOPjcqCFmjaChSbIHHPov svowtfUOt7B3+WyjXHk/Gpnu5K47KBTg+6Mx3rMOfI6WlN7qYDz+SX87xi+uS7yff9JvRS7g AAAAAAAA --------------ms030806040400070007050306-- From nobody Tue Jul 5 13:40:48 2016 Return-Path: X-Original-To: curdle@ietfa.amsl.com Delivered-To: curdle@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E2F5E12D193; Tue, 5 Jul 2016 13:40:43 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.7 X-Spam-Level: X-Spam-Status: No, score=-2.7 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id yMfKa-iSgmdQ; Tue, 5 Jul 2016 13:40:39 -0700 (PDT) Received: from mail-wm0-x232.google.com (mail-wm0-x232.google.com [IPv6:2a00:1450:400c:c09::232]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id BC39F12D520; Tue, 5 Jul 2016 13:40:38 -0700 (PDT) Received: by mail-wm0-x232.google.com with SMTP id 187so29042022wmz.1; Tue, 05 Jul 2016 13:40:38 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=subject:mime-version:from:in-reply-to:date:cc:message-id:references :to; bh=S2rUV1E0IHLU8idu4uDzNhF6qY/68LKvzRzqruV71aA=; b=VT9DD4uE7SMrWcX4pf/PBvKITwBOlmkEjTsdvmBlNpa+TrCGQsVs82icxSwuDk4yPT ilNXGT5cvL1eXwenXkop7LLWX/oK9MSkOulMslDgMSCv3xswpK3l0jR67vB9r72G/2xA PNDHRwgwnfj/o4bvRL7KSSJBE1dwyN/Bz5RkMAwIqrUgEWe5/06Wrew+pg+ggfTh9LBD b/2C1FWzYR+90IxPJri2ZpNhQ0x6iSrobl4wqUx934kFswPKXxPuo1YaGf7MlidU60kY Fztm0d3Dn+uDULEyySFdcLrMhi/vHu4GqMp8putYdrwu9/ufGj8vI597ptE/vvoZN4E6 cV7w== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:subject:mime-version:from:in-reply-to:date:cc :message-id:references:to; bh=S2rUV1E0IHLU8idu4uDzNhF6qY/68LKvzRzqruV71aA=; b=J8d5hz9txJBZUx2Px96XEy1APBrSxaXiu3gKGQg/DT5l168Nb1iUWV7qM3eUZj9ftY REWm37vHX+xEc0m27Bze+WUdlQ9kjBcHpvjj160nHGH3dpRUXRBKjXclYkljwyXtHiwV n52D1PfMXco11XW5ZGjcT5H/RtAJSEx5Nw+wXpsba0xogAX3F7kpRX6cIlXwqU6z0hPA netxPQ3fJqzd0WY16bDxy5jSIgXf5gViUTw7QcqsPUVLb7WwOPC9jZF7DT3cQxdGG6EN LLSyqEC0VI8ocoMobHAFAXk70cSNuXinU8jWBPC3+BBDjYnktbR6Bbot7aOFEwnJ+q8o zkqw== X-Gm-Message-State: ALyK8tJgzlw8Yg3vuAj52g51eP0X23x5eG2n6ubheat+G6ZKXJWO7xRPQ+wb62fiQ7lmdw== X-Received: by 10.28.223.215 with SMTP id w206mr17104151wmg.61.1467751237272; Tue, 05 Jul 2016 13:40:37 -0700 (PDT) Received: from [192.168.1.14] ([46.120.57.147]) by smtp.gmail.com with ESMTPSA id c142sm3257258wme.18.2016.07.05.13.40.35 (version=TLS1 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Tue, 05 Jul 2016 13:40:36 -0700 (PDT) Mime-Version: 1.0 (Mac OS X Mail 9.3 \(3124\)) Content-Type: multipart/signed; boundary="Apple-Mail=_2F53D7E9-F162-47CC-9B37-34C338119500"; protocol="application/pgp-signature"; micalg=pgp-sha256 X-Pgp-Agent: GPGMail 2.6b2 From: Yoav Nir In-Reply-To: <577C1ABB.4010809@cs.tcd.ie> Date: Tue, 5 Jul 2016 23:40:33 +0300 Message-Id: <1A4B72E6-6063-427B-B902-AFA9144ACD2E@gmail.com> References: <577C1ABB.4010809@cs.tcd.ie> To: Stephen Farrell X-Mailer: Apple Mail (2.3124) Archived-At: Cc: "spasm@ietf.org" , "curdle@ietf.org" Subject: Re: [Curdle] [Spasm] move lamps meeting slot to Friday? X-BeenThere: curdle@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "List for discussion of potential new security area wg." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 05 Jul 2016 20:40:44 -0000 --Apple-Mail=_2F53D7E9-F162-47CC-9B37-34C338119500 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 As I=E2=80=99d like to attend both quic and lamps, +1 > On 5 Jul 2016, at 11:38 PM, Stephen Farrell = wrote: >=20 >=20 > Hiya, >=20 > We've gotten a request to move the lamps meeting slot > back to Friday at 12:20 instead of curdle, which would > then remain cancelled. (There is one overlapping issue > that will be discussed in any case.) >=20 > That would put lamps against: rtcweb, lwig, ntp, tictoc, > bfd and aqm. >=20 > The reason to ask for the move was that we have a > contributor for whom the quic conflict is a problem. >=20 > As of now, lamps is on Wednesday 10:00 against avtcore, > mmusic, dhc, bmwg, netconf, rtgwg, ace, trans and > quic. >=20 > If this change would be good for you or a problem for > you please let me know off or on list, ideally before > Monday, July 11. >=20 > Thanks, > S. >=20 > _______________________________________________ > Spasm mailing list > Spasm@ietf.org > https://www.ietf.org/mailman/listinfo/spasm --Apple-Mail=_2F53D7E9-F162-47CC-9B37-34C338119500 Content-Transfer-Encoding: 7bit Content-Disposition: attachment; filename=signature.asc Content-Type: application/pgp-signature; name=signature.asc Content-Description: Message signed with OpenPGP using GPGMail -----BEGIN PGP SIGNATURE----- iQEcBAEBCAAGBQJXfBtCAAoJECXR4BOacZZUovAIAMeavnU89GPB6H/9JQU0jEjq j1a0I6QZWWrbZf3oaroXsj5AJWWDKv7MjhZW25E+w++12CI+ZbyTojVwBpoL8fN9 iKizuV6PS9fYrIZVVeswjsnJlTDjkOUEGn6LzfZVUJrF+dM9OOQqOt6TyjHWbFWE /dsSpiU2K0M9WzV/76QmizYAwvo6fKFJjtsd8CGW/4tfhKa5Dum2MmK2phGiVL4d Ce4a3+LTsa/uk5pl0CfJojd02Ff6kgjFayinOahgelVAPqgaavaeMjcuMmoeJW7I r9w9O/Yiydisn05Xc1fgy0gpC50D9LNxk+GLi08/0Lsnd8FaSDRk7YJKseFS6Gk= =/rqr -----END PGP SIGNATURE----- --Apple-Mail=_2F53D7E9-F162-47CC-9B37-34C338119500-- From nobody Tue Jul 5 14:26:25 2016 Return-Path: X-Original-To: curdle@ietfa.amsl.com Delivered-To: curdle@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id CF7EE12B022 for ; Tue, 5 Jul 2016 14:26:23 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_NONE=-0.0001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id CSSpYdMgzz9J for ; Tue, 5 Jul 2016 14:26:22 -0700 (PDT) Received: from smtp3.pacifier.net (smtp3.pacifier.net [64.255.237.177]) (using TLSv1 with cipher ADH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 14E14127078 for ; Tue, 5 Jul 2016 14:26:22 -0700 (PDT) Received: from hebrews (173-8-216-38-Oregon.hfc.comcastbusiness.net [173.8.216.38]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) (Authenticated sender: schaad@nwlink.com) by smtp3.pacifier.net (Postfix) with ESMTPSA id 6CCF538F01 for ; Tue, 5 Jul 2016 14:26:21 -0700 (PDT) From: "Jim Schaad" To: Date: Tue, 5 Jul 2016 14:26:20 -0700 Message-ID: <041301d1d703$dfd5f5b0$9f81e110$@augustcellars.com> MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit X-Mailer: Microsoft Outlook 16.0 Thread-Index: AdHXA7iH0jHJyiS7Qvuip8uwy/74AA== Content-Language: en-us Archived-At: Subject: [Curdle] JOSE document wrt to ECDH and EdDSA for the CFRG curves X-BeenThere: curdle@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "List for discussion of potential new security area wg." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 05 Jul 2016 21:26:24 -0000 The chairs are planning on advancing this document to the ADs after the IETF meeting in Berlin. This gives a chance to comment if you wish https://datatracker.ietf.org/doc/draft-ietf-jose-cfrg-curves/ Jim From nobody Wed Jul 6 07:21:02 2016 Return-Path: X-Original-To: curdle@ietfa.amsl.com Delivered-To: curdle@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7913112D7A2 for ; Wed, 6 Jul 2016 07:21:00 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.701 X-Spam-Level: X-Spam-Status: No, score=-2.701 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=sn3rd.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id TzEmpId-q7-6 for ; Wed, 6 Jul 2016 07:20:56 -0700 (PDT) Received: from mail-qk0-x22e.google.com (mail-qk0-x22e.google.com [IPv6:2607:f8b0:400d:c09::22e]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 9070C12D684 for ; Wed, 6 Jul 2016 07:20:01 -0700 (PDT) Received: by mail-qk0-x22e.google.com with SMTP id s126so31948552qkh.2 for ; Wed, 06 Jul 2016 07:20:01 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sn3rd.com; s=google; h=mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=oQQRZBNSqIJ/eMgNuaVT4migCX/3RNpsBpVGM5y6wVQ=; b=cN8X/BamHIBzz5UDemXm9uXsDcqBYkza+HdVPTqPLRf6OoRfIw6GEyReOObwL9dHPe a9PNS7RxY5YAJLrojUWXdPR3cvm8CeO/tLN81XDP2Etf63RHJmPvmYEwDdeH/vwMRiR0 rMPyaEZ54clKhBcGWTkit9eBMtE9yBTBgNUew= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=oQQRZBNSqIJ/eMgNuaVT4migCX/3RNpsBpVGM5y6wVQ=; b=LDJ3uGwPAgrMf+FueTsGgIhDaLHkjUUriSmlN9p7n8pm5SNuRMx7p/gDh2KdMgIOdc PtOOWJ9YtT6e/zrZH/wjDYbNx7ZLr6EEViTl2XxamV5p9razjFSs5Dk7+ip/7Qi65rAA qX8Dibi+1T8hXVSh3y/vzrc9n4TV9CbxYk5p4b5iToxIuoPTLejnk2tCRmrt5ZxMqynA GI2tA9i4h9/DmXGLK2tJDnbYR1O69N934HohGA61L32OloZoiP/XZEXNighkzdJmC5cz 1wLwGYxpaXO5y1Bilz2Me26/obymWcRqfPxwPit4b48LukuuCYSUExLgq2CA5Vii/IX3 1F1w== X-Gm-Message-State: ALyK8tKmVho+GTDplExfaJ6p+iZ+nk6FXsUb6XH/+9U+rMX08SDXmJP1762C8PxzqioHbA== X-Received: by 10.55.170.20 with SMTP id t20mr23615842qke.162.1467814800699; Wed, 06 Jul 2016 07:20:00 -0700 (PDT) Received: from [172.16.0.112] ([96.231.230.69]) by smtp.gmail.com with ESMTPSA id u87sm58790qkl.30.2016.07.06.07.19.59 (version=TLS1 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Wed, 06 Jul 2016 07:20:00 -0700 (PDT) Content-Type: text/plain; charset=utf-8 Mime-Version: 1.0 (Mac OS X Mail 9.3 \(3124\)) From: Sean Turner In-Reply-To: <1A4B72E6-6063-427B-B902-AFA9144ACD2E@gmail.com> Date: Wed, 6 Jul 2016 10:19:58 -0400 Content-Transfer-Encoding: quoted-printable Message-Id: References: <577C1ABB.4010809@cs.tcd.ie> <1A4B72E6-6063-427B-B902-AFA9144ACD2E@gmail.com> To: Stephen Farrell X-Mailer: Apple Mail (2.3124) Archived-At: Cc: "spasm@ietf.org" , "curdle@ietf.org" Subject: Re: [Curdle] [Spasm] move lamps meeting slot to Friday? X-BeenThere: curdle@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "List for discussion of potential new security area wg." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 06 Jul 2016 14:21:00 -0000 rtcweb is a conflict for me (co-chair) but since I=E2=80=99ll be remote = I can be in two rooms at once ;) spt > On Jul 05, 2016, at 16:40, Yoav Nir wrote: >=20 > As I=E2=80=99d like to attend both quic and lamps, +1 >=20 >> On 5 Jul 2016, at 11:38 PM, Stephen Farrell = wrote: >>=20 >>=20 >> Hiya, >>=20 >> We've gotten a request to move the lamps meeting slot >> back to Friday at 12:20 instead of curdle, which would >> then remain cancelled. (There is one overlapping issue >> that will be discussed in any case.) >>=20 >> That would put lamps against: rtcweb, lwig, ntp, tictoc, >> bfd and aqm. >>=20 >> The reason to ask for the move was that we have a >> contributor for whom the quic conflict is a problem. >>=20 >> As of now, lamps is on Wednesday 10:00 against avtcore, >> mmusic, dhc, bmwg, netconf, rtgwg, ace, trans and >> quic. >>=20 >> If this change would be good for you or a problem for >> you please let me know off or on list, ideally before >> Monday, July 11. >>=20 >> Thanks, >> S. >>=20 >> _______________________________________________ >> Spasm mailing list >> Spasm@ietf.org >> https://www.ietf.org/mailman/listinfo/spasm >=20 > _______________________________________________ > Spasm mailing list > Spasm@ietf.org > https://www.ietf.org/mailman/listinfo/spasm From nobody Mon Jul 11 10:20:51 2016 Return-Path: X-Original-To: curdle@ietfa.amsl.com Delivered-To: curdle@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2BF8812D0CC; Mon, 11 Jul 2016 10:20:50 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -5.588 X-Spam-Level: X-Spam-Status: No, score=-5.588 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, RP_MATCHES_RCVD=-1.287, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cs.tcd.ie Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id I1dvMwNywOjb; Mon, 11 Jul 2016 10:20:47 -0700 (PDT) Received: from mercury.scss.tcd.ie (mercury.scss.tcd.ie [134.226.56.6]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A89A012D0C4; Mon, 11 Jul 2016 10:20:47 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by mercury.scss.tcd.ie (Postfix) with ESMTP id B5853BE3F; Mon, 11 Jul 2016 18:20:45 +0100 (IST) X-Virus-Scanned: Debian amavisd-new at scss.tcd.ie Received: from mercury.scss.tcd.ie ([127.0.0.1]) by localhost (mercury.scss.tcd.ie [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 4x-3Gl5M6TGz; Mon, 11 Jul 2016 18:20:43 +0100 (IST) Received: from [10.154.240.60] (unknown [217.9.105.211]) by mercury.scss.tcd.ie (Postfix) with ESMTPSA id E57A8BE3E; Mon, 11 Jul 2016 18:20:42 +0100 (IST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cs.tcd.ie; s=mail; t=1468257643; bh=Zwjz9j4CLVr7o40z5cJIXNQ9gT8RZriPzpzSPqTXwRw=; h=Subject:To:References:From:Date:In-Reply-To:From; b=HAIAFEKPbcXkiFE95YM79EOz4M7Adhrn6HFmUMny2Qg0vsjYCIEtnIWiT2BOxVFsw +T7xqMXwdHGv+FX4G0/WXlGCnM9FcLMZwiH/Vz9GMfTyptBfUjqujpa1LjlptwKo15 4KGCkJhbJn3vB07alfalUq5bkCqwK98/ltLEpOAo= To: "spasm@ietf.org" , "curdle@ietf.org" References: <577C1ABB.4010809@cs.tcd.ie> From: Stephen Farrell Openpgp: id=D66EA7906F0B897FB2E97D582F3C8736805F8DA2; url= Message-ID: <5783D56A.8070803@cs.tcd.ie> Date: Mon, 11 Jul 2016 18:20:42 +0100 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:38.0) Gecko/20100101 Thunderbird/38.8.0 MIME-Version: 1.0 In-Reply-To: <577C1ABB.4010809@cs.tcd.ie> Content-Type: multipart/signed; protocol="application/pkcs7-signature"; micalg=sha-256; boundary="------------ms090104060707050206000107" Archived-At: Subject: Re: [Curdle] move lamps meeting slot to Friday? X-BeenThere: curdle@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "List for discussion of potential new security area wg." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 11 Jul 2016 17:20:50 -0000 This is a cryptographically signed message in MIME format. --------------ms090104060707050206000107 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Dear secretariat (bcc'd): So I only got positive feedback on this. Please do make the move to Friday for lamps and cancel curdle. I guess you'll send some announcement. Cheers, S. PS: For those who wonder, the secretariat are bcc'd as mailing them causes creation of a new ticket, and so does replying to this mail, so better to not have such replies as they just cause useless tickets that have to be closed. On 05/07/16 21:38, Stephen Farrell wrote: >=20 > Hiya, >=20 > We've gotten a request to move the lamps meeting slot > back to Friday at 12:20 instead of curdle, which would > then remain cancelled. (There is one overlapping issue > that will be discussed in any case.) >=20 > That would put lamps against: rtcweb, lwig, ntp, tictoc, > bfd and aqm. >=20 > The reason to ask for the move was that we have a > contributor for whom the quic conflict is a problem. >=20 > As of now, lamps is on Wednesday 10:00 against avtcore, > mmusic, dhc, bmwg, netconf, rtgwg, ace, trans and > quic. >=20 > If this change would be good for you or a problem for > you please let me know off or on list, ideally before > Monday, July 11. >=20 > Thanks, > S. >=20 >=20 >=20 > _______________________________________________ > Curdle mailing list > Curdle@ietf.org > https://www.ietf.org/mailman/listinfo/curdle >=20 --------------ms090104060707050206000107 Content-Type: application/pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="smime.p7s" Content-Description: S/MIME Cryptographic Signature MIAGCSqGSIb3DQEHAqCAMIACAQExDzANBglghkgBZQMEAgEFADCABgkqhkiG9w0BBwEAAKCC CvIwggUIMIID8KADAgECAhBPzaE7pzYviUJyhmHTFBdnMA0GCSqGSIb3DQEBCwUAMHUxCzAJ BgNVBAYTAklMMRYwFAYDVQQKEw1TdGFydENvbSBMdGQuMSkwJwYDVQQLEyBTdGFydENvbSBD ZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTEjMCEGA1UEAxMaU3RhcnRDb20gQ2xhc3MgMSBDbGll bnQgQ0EwHhcNMTYwMjA5MDkyODE1WhcNMTcwMjA5MDkyODE1WjBOMSIwIAYDVQQDDBlzdGVw aGVuLmZhcnJlbGxAY3MudGNkLmllMSgwJgYJKoZIhvcNAQkBFhlzdGVwaGVuLmZhcnJlbGxA Y3MudGNkLmllMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAtuC0rYze/2JinSra C9F2RjGdQZjNALLcW9C3WKTwYII3wBslobmHuPEYE5JaGItmzuKnAW619R1rD/kfoNWC19N3 rBZ6UX9Cmb9D9exCwYIwVuSwjrCQWGxgCtNQTrwKzCCpI790GRiMTvxvO7UmzmBrCaBLiZW5 R0fBjK5Yn6hUhAzGBkNbkIEL28cLJqH0yVz7Kl92OlzrQqTPEts5m6cDnNdY/ADfeAX18c1r dxZqcAxhLotrCqgsVA4ilbQDMMXGTLlB5TP35HeWZuGBU7xu003rLcFLdOkD8xvpJoYZy9Kt 3oABXPS5yqtMK+XCNdqmMn+4mOtLwQSMmPCSiQIDAQABo4IBuTCCAbUwCwYDVR0PBAQDAgSw MB0GA1UdJQQWMBQGCCsGAQUFBwMCBggrBgEFBQcDBDAJBgNVHRMEAjAAMB0GA1UdDgQWBBQJ QhvwQ5Fl372Z6xqo6fdn8XejTTAfBgNVHSMEGDAWgBQkgWw5Yb5JD4+3G0YrySi1J0htaDBv BggrBgEFBQcBAQRjMGEwJAYIKwYBBQUHMAGGGGh0dHA6Ly9vY3NwLnN0YXJ0c3NsLmNvbTA5 BggrBgEFBQcwAoYtaHR0cDovL2FpYS5zdGFydHNzbC5jb20vY2VydHMvc2NhLmNsaWVudDEu Y3J0MDgGA1UdHwQxMC8wLaAroCmGJ2h0dHA6Ly9jcmwuc3RhcnRzc2wuY29tL3NjYS1jbGll bnQxLmNybDAkBgNVHREEHTAbgRlzdGVwaGVuLmZhcnJlbGxAY3MudGNkLmllMCMGA1UdEgQc MBqGGGh0dHA6Ly93d3cuc3RhcnRzc2wuY29tLzBGBgNVHSAEPzA9MDsGCysGAQQBgbU3AQIE MCwwKgYIKwYBBQUHAgEWHmh0dHA6Ly93d3cuc3RhcnRzc2wuY29tL3BvbGljeTANBgkqhkiG 9w0BAQsFAAOCAQEArzrSv2C8PlBBmGuiGrzm2Wma46/KHtXmZYS0bsd43pM66Pc/MsqPE0HD C1GzMFfwB6BfkJn8ijNSIhlgj898WzjvnpM/SO8KStjlB8719ig/xKISrOl5mX55XbFlQtX9 U6MrqRgbDIATxhD9IDr+ryvovDzChqgQj7mt2jYr4mdlRjsjod3H1VY6XglRmaaNGZfsCARM aE/TU5SXIiqauwt5KxNGYAY67QkOBs7O1FkSXpTk7+1MmzJMF4nP8QQ5n8vhVNseF+/Wm7ai 9mtnrkLbaznMsy/ULo/C2yuLUWTbZZbf4EKNmVdme6tUDgYkFjAFOblfA7W1fSPiQGagYzCC BeIwggPKoAMCAQICEGunin0K14jWUQr5WeTntOEwDQYJKoZIhvcNAQELBQAwfTELMAkGA1UE BhMCSUwxFjAUBgNVBAoTDVN0YXJ0Q29tIEx0ZC4xKzApBgNVBAsTIlNlY3VyZSBEaWdpdGFs IENlcnRpZmljYXRlIFNpZ25pbmcxKTAnBgNVBAMTIFN0YXJ0Q29tIENlcnRpZmljYXRpb24g QXV0aG9yaXR5MB4XDTE1MTIxNjAxMDAwNVoXDTMwMTIxNjAxMDAwNVowdTELMAkGA1UEBhMC SUwxFjAUBgNVBAoTDVN0YXJ0Q29tIEx0ZC4xKTAnBgNVBAsTIFN0YXJ0Q29tIENlcnRpZmlj YXRpb24gQXV0aG9yaXR5MSMwIQYDVQQDExpTdGFydENvbSBDbGFzcyAxIENsaWVudCBDQTCC ASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAL192vfDon2D9luC/dtbX64eG3XAtRmv mCSsu1d52DXsCR58zJQbCtB2/A5uFqNxWacpXGGtTCRk9dEDBlmixEd8QiLkUfvHpJX/xKnm VkS6Iye8wUbYzMsDzgnpazlPg19dnSqfhM+Cevdfa89VLnUztRr2cgmCfyO9Otrh7LJDPG+4 D8ZnAqDtVB8MKYJL6QgKyVhhaBc4y3bGWxKyXEtx7QIZZGxPwSkzK3WIN+VKNdkiwTubW5PI dopmykwvIjLPqbJK7yPwFZYekKE015OsW6FV+s4DIM8UlVS8pkIsoGGJtMuWjLL4tq2hYQuu N0jhrxK1ljz50hH23gA9cbMCAwEAAaOCAWQwggFgMA4GA1UdDwEB/wQEAwIBBjAdBgNVHSUE FjAUBggrBgEFBQcDAgYIKwYBBQUHAwQwEgYDVR0TAQH/BAgwBgEB/wIBADAyBgNVHR8EKzAp MCegJaAjhiFodHRwOi8vY3JsLnN0YXJ0c3NsLmNvbS9zZnNjYS5jcmwwZgYIKwYBBQUHAQEE WjBYMCQGCCsGAQUFBzABhhhodHRwOi8vb2NzcC5zdGFydHNzbC5jb20wMAYIKwYBBQUHMAKG JGh0dHA6Ly9haWEuc3RhcnRzc2wuY29tL2NlcnRzL2NhLmNydDAdBgNVHQ4EFgQUJIFsOWG+ SQ+PtxtGK8kotSdIbWgwHwYDVR0jBBgwFoAUTgvvGqRAW6UXaYcwyjRoQ9BBrvIwPwYDVR0g BDgwNjA0BgRVHSAAMCwwKgYIKwYBBQUHAgEWHmh0dHA6Ly93d3cuc3RhcnRzc2wuY29tL3Bv bGljeTANBgkqhkiG9w0BAQsFAAOCAgEAi+P3h+wBi4StDwECW5zhIycjBL008HACblIf26HY 0JdOruKbrWDsXUsiI0j/7Crft9S5oxvPiDtVqspBOB/y5uzSns1lZwh7sG96bYBZpcGzGxpF NjDmQbcM3yl3WFIRS4WhNrsOY14V7y2IrUGsvetsD+bjyOngCIVeC/GmsmtbuLOzJ606tEc9 uRbhjTu/b0x2Fo+/e7UkQvKzNeo7OMhijixaULyINBfCBJb+e29bLafgu6JqjOUJ9eXXj20p 6q/CW+uVrZiSW57+q5an2P2i7hP85jQJcy5j4HzA0rSiF3YPhKGAWUxKPMAVGgcYoXzWydOv Z3UDsTDTagXpRDIKQLZo02wrlxY6iMFqvlzsemVf1odhQJmi7Eh5TbxI40kDGcBOBHhwnaOu mZhLP+SWJQnjpLpSlUOj95uf1zo9oz9e0NgIJoz/tdfrBzez76xtDsK0KfUDHt1/q59BvDI7 RX6gVr0fQoCyMczNzCTcRXYHY0tq2J0oT+bsb6sH2b4WVWAiJKnSYaWDjdA70qHX4mq9MIjO /ZskmSY8wtAk24orAc0vwXgYanqNsBX5Yv4sN4Z9VyrwMdLcusP7HJgRdAGKpkR2I9U4zEsN JQJewM7S4Jalo1DyPrLpL2nTET8ZrSl5Utp1UeGp/2deoprGevfnxWB+vHNQiu85o6MxggPM MIIDyAIBATCBiTB1MQswCQYDVQQGEwJJTDEWMBQGA1UEChMNU3RhcnRDb20gTHRkLjEpMCcG A1UECxMgU3RhcnRDb20gQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkxIzAhBgNVBAMTGlN0YXJ0 Q29tIENsYXNzIDEgQ2xpZW50IENBAhBPzaE7pzYviUJyhmHTFBdnMA0GCWCGSAFlAwQCAQUA oIICEzAYBgkqhkiG9w0BCQMxCwYJKoZIhvcNAQcBMBwGCSqGSIb3DQEJBTEPFw0xNjA3MTEx NzIwNDJaMC8GCSqGSIb3DQEJBDEiBCD4RE5lFQC/MeaDZTPqd7zD/zle+LQ0mmTEILGZGD4s ejBsBgkqhkiG9w0BCQ8xXzBdMAsGCWCGSAFlAwQBKjALBglghkgBZQMEAQIwCgYIKoZIhvcN AwcwDgYIKoZIhvcNAwICAgCAMA0GCCqGSIb3DQMCAgFAMAcGBSsOAwIHMA0GCCqGSIb3DQMC AgEoMIGaBgkrBgEEAYI3EAQxgYwwgYkwdTELMAkGA1UEBhMCSUwxFjAUBgNVBAoTDVN0YXJ0 Q29tIEx0ZC4xKTAnBgNVBAsTIFN0YXJ0Q29tIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MSMw IQYDVQQDExpTdGFydENvbSBDbGFzcyAxIENsaWVudCBDQQIQT82hO6c2L4lCcoZh0xQXZzCB nAYLKoZIhvcNAQkQAgsxgYyggYkwdTELMAkGA1UEBhMCSUwxFjAUBgNVBAoTDVN0YXJ0Q29t IEx0ZC4xKTAnBgNVBAsTIFN0YXJ0Q29tIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MSMwIQYD VQQDExpTdGFydENvbSBDbGFzcyAxIENsaWVudCBDQQIQT82hO6c2L4lCcoZh0xQXZzANBgkq hkiG9w0BAQEFAASCAQB7H6Myv1RMOn34Ll+W5TQFWGBKN+DGyAfGygnXbkKxx36pz3k18Fqk f+7g+HlZeLpckkCGtrAz56J6UGGZhQX4AB1YH9mH3/xBHq1Y2THkeOXjaMSpSi3LLm3wnBvs 3GV2Q9fX8tDTzgDgcSh78zgPSOSKjrZPnkRPm6+lWiH2mn02Cre5GNqabiVGrR4Q9VQuuo2a msEKjgy4BeAzRSqVC8MBr+wX2sRrOTs2ZjDONlNdM8I2xtNgAcC2ll3hzx634egnEC7lz3vy aGYppxh6l8k7GEllP60Z2gX2P5rKLw3g453zKTEVk5vQczf7QSP0I3myTrlhgTXO0s1SHv/b AAAAAAAA --------------ms090104060707050206000107-- From nobody Fri Jul 22 04:36:54 2016 Return-Path: X-Original-To: curdle@ietfa.amsl.com Delivered-To: curdle@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E1E8D12DDCD for ; Fri, 22 Jul 2016 04:36:52 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -3.187 X-Spam-Level: X-Spam-Status: No, score=-3.187 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RP_MATCHES_RCVD=-1.287] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 1PbbdNoy2acV for ; Fri, 22 Jul 2016 04:36:49 -0700 (PDT) Received: from welho-filter1.welho.com (welho-filter1.welho.com [83.102.41.23]) by ietfa.amsl.com (Postfix) with ESMTP id 6BBB212DDC9 for ; Fri, 22 Jul 2016 04:36:49 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by welho-filter1.welho.com (Postfix) with ESMTP id 037CC571; Fri, 22 Jul 2016 14:36:48 +0300 (EEST) X-Virus-Scanned: Debian amavisd-new at pp.htv.fi Received: from welho-smtp3.welho.com ([IPv6:::ffff:83.102.41.86]) by localhost (welho-filter1.welho.com [::ffff:83.102.41.23]) (amavisd-new, port 10024) with ESMTP id f5sBRJ9vJ_zm; Fri, 22 Jul 2016 14:36:47 +0300 (EEST) Received: from LK-Perkele-V2 (87-100-177-32.bb.dnainternet.fi [87.100.177.32]) (using TLSv1 with cipher ECDHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by welho-smtp3.welho.com (Postfix) with ESMTPSA id 969942310; Fri, 22 Jul 2016 14:36:47 +0300 (EEST) Date: Fri, 22 Jul 2016 14:36:42 +0300 From: Ilari Liusvaara To: "curdle@ietf.org" Message-ID: <20160722113642.GA24793@LK-Perkele-V2.elisa-laajakaista.fi> References: <1463470661.2914.4.camel@redhat.com> <1463647224.3558.14.camel@redhat.com> <1553247361.41476124.1465542998520.JavaMail.zimbra@redhat.com> <015201d1caa9$ce55ac60$6b010520$@augustcellars.com> <2DD56D786E600F45AC6BDE7DA4E8A8C117F26424@eusaamb107.ericsson.se> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.6.0 (2016-04-01) Sender: ilariliusvaara@welho.com Archived-At: Cc: Daniel Migault Subject: Re: [Curdle] draft-ietf-curdle-pkix-00: a simplification proposal X-BeenThere: curdle@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "List for discussion of potential new security area wg." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 22 Jul 2016 11:36:53 -0000 On Sat, Jun 25, 2016 at 11:49:25PM -0400, Benjamin Kaduk wrote: > David has basically convinced me of the superiority of the "one joint and > keep it well-oiled" philosophy (i.e., top-level OID) -- it's just too easy > for implementations to end up doing bad things when there are separate > parameters involved. Yeah, I think separate top-level OID seems the cleanest. Furthermore, I listened to the lamps session today, and they agreeed (strong consensus?) to send recommedation to CURDLE for that scheme. And as for other questionable reasons, it would also be more compact (assuming we can sub-OID the arcs, which I think we can): For using +1 byte on OID, we can jettison parameters, which is -3 bytes, for net of -2 bytes. :-) More concretely: Something like (in wire form for SubjectPublicKeyInfo.algorithm): 30 06 06 04 2B 65 64 01 Ed25519 30 06 06 04 2B 65 64 02 Ed25519ph 30 06 06 04 2B 65 64 03 X25519 30 06 06 04 2B 65 64 04 Ed448 30 06 06 04 2B 65 64 05 Ed448ph 30 06 06 04 2B 65 64 06 X448 And then for Certificate.signatureAlgorithm: 30 06 06 04 2B 65 64/65 01 Ed25519 30 06 06 04 2B 65 64/65 02 Ed25519ph 30 06 06 04 2B 65 64/65 04 Ed448 30 06 06 04 2B 65 64/65 05 Ed448ph Where 64 or 65 is chosen based on if reusing the OID is OK (64) or not (65). Then e.g. Ed25519 SPKI would be encoded as: 30 2B 30 06 06 04 2B 65 64 01 03 21 00 <32 byte pubkey> -Ilari From nobody Fri Jul 22 06:02:52 2016 Return-Path: X-Original-To: curdle@ietfa.amsl.com Delivered-To: curdle@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2DD2712D097 for ; Fri, 22 Jul 2016 06:02:51 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -101.9 X-Spam-Level: X-Spam-Status: No, score=-101.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, USER_IN_WHITELIST=-100] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id rcIcjQXHfDZs for ; Fri, 22 Jul 2016 06:02:49 -0700 (PDT) Received: from mail.smeinc.net (mail.smeinc.net [209.135.209.11]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E57B912B05F for ; Fri, 22 Jul 2016 06:02:47 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by mail.smeinc.net (Postfix) with ESMTP id DA69E300571 for ; Fri, 22 Jul 2016 09:02:45 -0400 (EDT) X-Virus-Scanned: amavisd-new at mail.smeinc.net Received: from mail.smeinc.net ([127.0.0.1]) by localhost (mail.smeinc.net [127.0.0.1]) (amavisd-new, port 10026) with ESMTP id G-G64iFbrp8p for ; Fri, 22 Jul 2016 09:02:44 -0400 (EDT) Received: from dhcp-b4d9.meeting.ietf.org (dhcp-b4d9.meeting.ietf.org [31.133.180.217]) by mail.smeinc.net (Postfix) with ESMTPSA id CC07530029F; Fri, 22 Jul 2016 09:02:43 -0400 (EDT) Content-Type: text/plain; charset=us-ascii Mime-Version: 1.0 (Mac OS X Mail 7.3 \(1878.6\)) From: Russ Housley In-Reply-To: <20160722113642.GA24793@LK-Perkele-V2.elisa-laajakaista.fi> Date: Fri, 22 Jul 2016 09:02:42 -0400 Content-Transfer-Encoding: quoted-printable Message-Id: References: <1463470661.2914.4.camel@redhat.com> <1463647224.3558.14.camel@redhat.com> <1553247361.41476124.1465542998520.JavaMail.zimbra@redhat.com> <015201d1caa9$ce55ac60$6b010520$@augustcellars.com> <2DD56D786E600F45AC6BDE7DA4E8A8C117F26424@eusaamb107.ericsson.se> <20160722113642.GA24793@LK-Perkele-V2.elisa-laajakaista.fi> To: Ilari Liusvaara X-Mailer: Apple Mail (2.1878.6) Archived-At: Cc: "curdle@ietf.org" , Daniel Migault Subject: Re: [Curdle] draft-ietf-curdle-pkix-00: a simplification proposal X-BeenThere: curdle@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "List for discussion of potential new security area wg." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 22 Jul 2016 13:02:51 -0000 I think the same OID can be used in SubjectPublicKeyInfo.algorithm and = Certificate.signatureAlgorithm and SignerInfo.signatureAlgorithm. Russ On Jul 22, 2016, at 7:36 AM, Ilari Liusvaara = wrote: > On Sat, Jun 25, 2016 at 11:49:25PM -0400, Benjamin Kaduk wrote: >> David has basically convinced me of the superiority of the "one joint = and >> keep it well-oiled" philosophy (i.e., top-level OID) -- it's just too = easy >> for implementations to end up doing bad things when there are = separate >> parameters involved. >=20 > Yeah, I think separate top-level OID seems the cleanest. >=20 > Furthermore, I listened to the lamps session today, and they agreeed > (strong consensus?) to send recommedation to CURDLE for that scheme. >=20 >=20 > And as for other questionable reasons, it would also be more compact > (assuming we can sub-OID the arcs, which I think we can): For using > +1 byte on OID, we can jettison parameters, which is -3 bytes, for > net of -2 bytes. :-) >=20 >=20 > More concretely: >=20 >=20 > Something like (in wire form for SubjectPublicKeyInfo.algorithm): > 30 06 06 04 2B 65 64 01 Ed25519 > 30 06 06 04 2B 65 64 02 Ed25519ph > 30 06 06 04 2B 65 64 03 X25519 > 30 06 06 04 2B 65 64 04 Ed448 > 30 06 06 04 2B 65 64 05 Ed448ph > 30 06 06 04 2B 65 64 06 X448 >=20 > And then for Certificate.signatureAlgorithm: > 30 06 06 04 2B 65 64/65 01 Ed25519 > 30 06 06 04 2B 65 64/65 02 Ed25519ph > 30 06 06 04 2B 65 64/65 04 Ed448 > 30 06 06 04 2B 65 64/65 05 Ed448ph >=20 >=20 > Where 64 or 65 is chosen based on if reusing the OID is OK (64) > or not (65). >=20 >=20 > Then e.g. Ed25519 SPKI would be encoded as: >=20 > 30 2B 30 06 06 04 2B 65 64 01 03 21 00 <32 byte pubkey> >=20 >=20 >=20 > -Ilari >=20 > _______________________________________________ > Curdle mailing list > Curdle@ietf.org > https://www.ietf.org/mailman/listinfo/curdle From nobody Fri Jul 22 07:08:06 2016 Return-Path: X-Original-To: curdle@ietfa.amsl.com Delivered-To: curdle@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 31346126FDC for ; Fri, 22 Jul 2016 07:08:05 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -3.986 X-Spam-Level: X-Spam-Status: No, score=-3.986 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HEADER_FROM_DIFFERENT_DOMAINS=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, RP_MATCHES_RCVD=-1.287, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=chromium.org Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id KcNr3Sk5Pd36 for ; Fri, 22 Jul 2016 07:08:03 -0700 (PDT) Received: from mail-lf0-x233.google.com (mail-lf0-x233.google.com [IPv6:2a00:1450:4010:c07::233]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id CC18312B03A for ; Fri, 22 Jul 2016 07:08:00 -0700 (PDT) Received: by mail-lf0-x233.google.com with SMTP id f93so86511366lfi.2 for ; Fri, 22 Jul 2016 07:08:00 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org; s=google; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=MMRTvtre0Kmt6VN2k+suko7feMq+8tlVsJIPSaSjsk8=; b=Gnv4zKKfySm6Rhy+S1IA6mqk1FdBETrmJqmwXtL/Dic6y+tjTYiTkr3+Hg3kUe6HB8 hSOFS2+n8PyPk90HVg93XIVu9kdAlpD/dMw0oPQ/Qd4QDK6xUlPKDyDjb1100FQJH6z8 cJLSEodtdRnsDOlGIyUOkFt7U+vrWQyQKp4Wc= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=MMRTvtre0Kmt6VN2k+suko7feMq+8tlVsJIPSaSjsk8=; b=I46sbmsEzlNkEwL51pUG8BA/ThjHWudzl/f09s3nn41l/W4Iu98xnm2uX9POglfg+h sdSGYHT/FRcVgkXwRTW/QQyWQEOPxjauAUXKwe3vVyu9SW5oEHynJk4Dry7KNP+Tml/B /mlJNLaZwNv7eUYRKt86nFlZ28LeFEKWYB1oMKZ9LdhKAmdcol6+DA3CZKI3EYNy6VO2 OrAqB1xutgkPiRn5l41oz5zD8ObIreOmcRQLVhtg5prCI35coH77TeASUehpCbmC1u0Q ylKkLRnsmUTKm4zhzhA1K2MvrMxYge4A80uMNBuZXlYL1aNZOl2sQmpAhWrZnu4Uf9dD DwLA== X-Gm-Message-State: AEkoousWQ374vANvNPfkh0chB+j9CWTpiN9bLGf7N5rdHzPTIaa3Jwkbw3lifMeDoTziFOFhK8SFRkdcTPOQC95+ X-Received: by 10.46.0.167 with SMTP id e39mr2697582lji.55.1469196478874; Fri, 22 Jul 2016 07:07:58 -0700 (PDT) MIME-Version: 1.0 References: <1463470661.2914.4.camel@redhat.com> <1463647224.3558.14.camel@redhat.com> <1553247361.41476124.1465542998520.JavaMail.zimbra@redhat.com> <015201d1caa9$ce55ac60$6b010520$@augustcellars.com> <2DD56D786E600F45AC6BDE7DA4E8A8C117F26424@eusaamb107.ericsson.se> <20160722113642.GA24793@LK-Perkele-V2.elisa-laajakaista.fi> In-Reply-To: From: David Benjamin Date: Fri, 22 Jul 2016 14:07:49 +0000 Message-ID: To: Russ Housley , Ilari Liusvaara Content-Type: multipart/alternative; boundary=001a1142c1303ac654053839f65a Archived-At: Cc: "curdle@ietf.org" , Daniel Migault Subject: Re: [Curdle] draft-ietf-curdle-pkix-00: a simplification proposal X-BeenThere: curdle@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "List for discussion of potential new security area wg." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 22 Jul 2016 14:08:05 -0000 --001a1142c1303ac654053839f65a Content-Type: text/plain; charset=UTF-8 +1 Also +1 to naming the ECDH/curve25519 OID as X25519 instead of Curve25519. I believe the current terminology is for "curve25519" to mean the curve and "X25519" to mean the DH function built on top of it. RFC 7748 also reflects this naming: https://www.ietf.org/mail-archive/web/cfrg/current/msg04996.html https://tools.ietf.org/html/rfc7748 On Fri, Jul 22, 2016 at 3:02 PM Russ Housley wrote: > I think the same OID can be used in SubjectPublicKeyInfo.algorithm and > Certificate.signatureAlgorithm and SignerInfo.signatureAlgorithm. > > Russ > > > On Jul 22, 2016, at 7:36 AM, Ilari Liusvaara > wrote: > > > On Sat, Jun 25, 2016 at 11:49:25PM -0400, Benjamin Kaduk wrote: > >> David has basically convinced me of the superiority of the "one joint > and > >> keep it well-oiled" philosophy (i.e., top-level OID) -- it's just too > easy > >> for implementations to end up doing bad things when there are separate > >> parameters involved. > > > > Yeah, I think separate top-level OID seems the cleanest. > > > > Furthermore, I listened to the lamps session today, and they agreeed > > (strong consensus?) to send recommedation to CURDLE for that scheme. > > > > > > And as for other questionable reasons, it would also be more compact > > (assuming we can sub-OID the arcs, which I think we can): For using > > +1 byte on OID, we can jettison parameters, which is -3 bytes, for > > net of -2 bytes. :-) > > > > > > More concretely: > > > > > > Something like (in wire form for SubjectPublicKeyInfo.algorithm): > > 30 06 06 04 2B 65 64 01 Ed25519 > > 30 06 06 04 2B 65 64 02 Ed25519ph > > 30 06 06 04 2B 65 64 03 X25519 > > 30 06 06 04 2B 65 64 04 Ed448 > > 30 06 06 04 2B 65 64 05 Ed448ph > > 30 06 06 04 2B 65 64 06 X448 > > > > And then for Certificate.signatureAlgorithm: > > 30 06 06 04 2B 65 64/65 01 Ed25519 > > 30 06 06 04 2B 65 64/65 02 Ed25519ph > > 30 06 06 04 2B 65 64/65 04 Ed448 > > 30 06 06 04 2B 65 64/65 05 Ed448ph > > > > > > Where 64 or 65 is chosen based on if reusing the OID is OK (64) > > or not (65). > > > > > > Then e.g. Ed25519 SPKI would be encoded as: > > > > 30 2B 30 06 06 04 2B 65 64 01 03 21 00 <32 byte pubkey> > > > > > > > > -Ilari > > > > _______________________________________________ > > Curdle mailing list > > Curdle@ietf.org > > https://www.ietf.org/mailman/listinfo/curdle > > _______________________________________________ > Curdle mailing list > Curdle@ietf.org > https://www.ietf.org/mailman/listinfo/curdle > --001a1142c1303ac654053839f65a Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable
+1

Also=C2=A0+1 to naming the ECDH/curv= e25519 OID as X25519 instead of Curve25519. I believe the current terminology is for "curve25519" to mean th= e curve and "X25519" to mean the DH function built on top of it. = RFC 7748 also reflects this naming:

On Fri, Jul 22, 2016 at 3:02 PM Russ Housley <housley@vigilsec.com= > wrote:
I think the same OID ca= n be used in SubjectPublicKeyInfo.algorithm and Certificate.signatureAlgori= thm and SignerInfo.signatureAlgorithm.

Russ


On Jul 22, 2016, at 7:36 AM, Ilari Liusvaara <ilariliusvaara@welho.com> wrote:=

> On Sat, Jun 25, 2016 at 11:49:25PM -0400, Benjamin Kaduk wrote:
>> David has basically convinced me of the superiority of the "o= ne joint and
>> keep it well-oiled" philosophy (i.e., top-level OID) -- it= 9;s just too easy
>> for implementations to end up doing bad things when there are sepa= rate
>> parameters involved.
>
> Yeah, I think separate top-level OID seems the cleanest.
>
> Furthermore, I listened to the lamps session today, and they agreeed > (strong consensus?) to send recommedation to CURDLE for that scheme. >
>
> And as for other questionable reasons, it would also be more compact > (assuming we can sub-OID the arcs, which I think we can): For using > +1 byte on OID, we can jettison parameters, which is -3 bytes, for
> net of -2 bytes. :-)
>
>
> More concretely:
>
>
> Something like (in wire form for SubjectPublicKeyInfo.algorithm):
> 30 06 06 04 2B 65 64 01=C2=A0 =C2=A0 =C2=A0 =C2=A0Ed25519
> 30 06 06 04 2B 65 64 02=C2=A0 =C2=A0 =C2=A0 =C2=A0Ed25519ph
> 30 06 06 04 2B 65 64 03=C2=A0 =C2=A0 =C2=A0 =C2=A0X25519
> 30 06 06 04 2B 65 64 04=C2=A0 =C2=A0 =C2=A0 =C2=A0Ed448
> 30 06 06 04 2B 65 64 05=C2=A0 =C2=A0 =C2=A0 =C2=A0Ed448ph
> 30 06 06 04 2B 65 64 06=C2=A0 =C2=A0 =C2=A0 =C2=A0X448
>
> And then for Certificate.signatureAlgorithm:
> 30 06 06 04 2B 65 64/65 01=C2=A0 =C2=A0 =C2=A0 =C2=A0Ed25519
> 30 06 06 04 2B 65 64/65 02=C2=A0 =C2=A0 =C2=A0 =C2=A0Ed25519ph
> 30 06 06 04 2B 65 64/65 04=C2=A0 =C2=A0 =C2=A0 =C2=A0Ed448
> 30 06 06 04 2B 65 64/65 05=C2=A0 =C2=A0 =C2=A0 =C2=A0Ed448ph
>
>
> Where 64 or 65 is chosen based on if reusing the OID is OK (64)
> or not (65).
>
>
> Then e.g. Ed25519 SPKI would be encoded as:
>
> 30 2B 30 06 06 04 2B 65 64 01 03 21 00 <32 byte pubkey>
>
>
>
> -Ilari
>
> _______________________________________________
> Curdle mailing list
> Curdle@ietf.org
> https://www.ietf.org/mailman/listinfo/curdle
_______________________________________________
Curdle mailing list
Curdle@ietf.org https://www.ietf.org/mailman/listinfo/curdle
--001a1142c1303ac654053839f65a-- From nobody Fri Jul 22 09:02:27 2016 Return-Path: X-Original-To: curdle@ietfa.amsl.com Delivered-To: curdle@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B7F1312DD90 for ; Fri, 22 Jul 2016 09:02:25 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -3.187 X-Spam-Level: X-Spam-Status: No, score=-3.187 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RP_MATCHES_RCVD=-1.287] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id d3kyZYS_0Quz for ; Fri, 22 Jul 2016 09:02:23 -0700 (PDT) Received: from welho-filter4.welho.com (welho-filter4.welho.com [83.102.41.26]) by ietfa.amsl.com (Postfix) with ESMTP id 488F612DB26 for ; Fri, 22 Jul 2016 09:02:22 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by welho-filter4.welho.com (Postfix) with ESMTP id 8F46B5027 for ; Fri, 22 Jul 2016 19:02:21 +0300 (EEST) X-Virus-Scanned: Debian amavisd-new at pp.htv.fi Received: from welho-smtp3.welho.com ([IPv6:::ffff:83.102.41.86]) by localhost (welho-filter4.welho.com [::ffff:83.102.41.26]) (amavisd-new, port 10024) with ESMTP id hQfN7s97KCxk for ; Fri, 22 Jul 2016 19:02:21 +0300 (EEST) Received: from LK-Perkele-V2 (87-100-177-32.bb.dnainternet.fi [87.100.177.32]) (using TLSv1 with cipher ECDHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by welho-smtp3.welho.com (Postfix) with ESMTPSA id 584C52310 for ; Fri, 22 Jul 2016 19:02:21 +0300 (EEST) Date: Fri, 22 Jul 2016 19:02:16 +0300 From: Ilari Liusvaara To: "curdle@ietf.org" Message-ID: <20160722160216.GA26177@LK-Perkele-V2.elisa-laajakaista.fi> References: <19075EB00EA7FE49AFF87E5818D673D4138D60C7@PRODEXMB01W.eagle.usaa.com> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline Content-Transfer-Encoding: 8bit In-Reply-To: User-Agent: Mutt/1.6.0 (2016-04-01) Sender: ilariliusvaara@welho.com Archived-At: Subject: Re: [Curdle] Proposal: Disallow Ed25519ph/Ed448ph for CA certificates X-BeenThere: curdle@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "List for discussion of potential new security area wg." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 22 Jul 2016 16:02:26 -0000 On Mon, Jun 13, 2016 at 10:12:55AM +0000, Dang, Quynh (Fed) wrote: > Hi all, > > Prehash or non-prehash, choosing the one which works well for all uses > (not just signing certs) is the right thing to do. I don¹t know how much > the non-prehash version is actually used right now (different from how > much it is supported in libraries). Well, I think that anything that: - technically _could_ sign "not technically constrained" CA certificate (regardless of if the key was ever intended to do that), and - _could_ ever sign anything that even partially comes from external sources (this includes cross-certs). Should use non-prehash. The reason for this is that non-prehash versions look to be _substantially_ weaker against attacks to the hash function (going by historical percedent), and the ultimate nightmare scenario is attacker managing to collide issued data with unconstrained CA certficate. Also, if one looks at the basic signed data items that float around in various PKIs, those include: - Certificates - OCSP responses - CRLs Now, certificates and should be fairly small. Few kilobytes (or at most few tens of kilobytes for certs with PQ key in them) or so. OCSP responses should be even smaller. On order of 100 bytes for signed size? This leaves CRLs, which could potentially be largish. But are those actually used that much? I did search for CRL for one practicular very high-activity WebPKI cert, and couldn't find it (it might not even exist). So presumably using non-prehash for everything would be feasible. -Ilari From nobody Fri Jul 22 10:46:32 2016 Return-Path: X-Original-To: curdle@ietfa.amsl.com Delivered-To: curdle@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8102B12D79F for ; Fri, 22 Jul 2016 10:46:31 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -3.187 X-Spam-Level: X-Spam-Status: No, score=-3.187 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RP_MATCHES_RCVD=-1.287] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 2wIRbMbqw2qN for ; Fri, 22 Jul 2016 10:46:28 -0700 (PDT) Received: from welho-filter4.welho.com (welho-filter4.welho.com [83.102.41.26]) by ietfa.amsl.com (Postfix) with ESMTP id 8295F12D795 for ; Fri, 22 Jul 2016 10:46:28 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by welho-filter4.welho.com (Postfix) with ESMTP id 339485054; Fri, 22 Jul 2016 20:46:27 +0300 (EEST) X-Virus-Scanned: Debian amavisd-new at pp.htv.fi Received: from welho-smtp2.welho.com ([IPv6:::ffff:83.102.41.85]) by localhost (welho-filter4.welho.com [::ffff:83.102.41.26]) (amavisd-new, port 10024) with ESMTP id p67pi5F6dcNT; Fri, 22 Jul 2016 20:46:25 +0300 (EEST) Received: from LK-Perkele-V2 (87-100-177-32.bb.dnainternet.fi [87.100.177.32]) (using TLSv1 with cipher ECDHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by welho-smtp2.welho.com (Postfix) with ESMTPSA id 811F827B; Fri, 22 Jul 2016 20:46:25 +0300 (EEST) Date: Fri, 22 Jul 2016 20:46:21 +0300 From: Ilari Liusvaara To: David Benjamin Message-ID: <20160722174620.GA26435@LK-Perkele-V2.elisa-laajakaista.fi> References: <1553247361.41476124.1465542998520.JavaMail.zimbra@redhat.com> <015201d1caa9$ce55ac60$6b010520$@augustcellars.com> <2DD56D786E600F45AC6BDE7DA4E8A8C117F26424@eusaamb107.ericsson.se> <20160722113642.GA24793@LK-Perkele-V2.elisa-laajakaista.fi> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.6.0 (2016-04-01) Sender: ilariliusvaara@welho.com Archived-At: Cc: "curdle@ietf.org" , Russ Housley , Daniel Migault Subject: Re: [Curdle] draft-ietf-curdle-pkix-00: a simplification proposal X-BeenThere: curdle@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "List for discussion of potential new security area wg." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 22 Jul 2016 17:46:31 -0000 On Fri, Jul 22, 2016 at 02:07:49PM +0000, David Benjamin wrote: > > On Fri, Jul 22, 2016 at 3:02 PM Russ Housley wrote: > > > I think the same OID can be used in SubjectPublicKeyInfo.algorithm and > > Certificate.signatureAlgorithm and SignerInfo.signatureAlgorithm. > > > > Russ > > Oops, I missed that not only there was strong consensus in LAMPS to recommend using separate top-level OIDs, they also recommended reuse OIDs across those three uses. > +1 > > Also +1 to naming the ECDH/curve25519 OID as X25519 instead of Curve25519. I > believe the current terminology is for "curve25519" to mean the curve and > "X25519" to mean the DH function built on top of it. RFC 7748 also reflects > this naming: > https://www.ietf.org/mail-archive/web/cfrg/current/msg04996.html > https://tools.ietf.org/html/rfc7748 So maybe something like this: ---------------------------------------------------------------------- The algorithm identifiers, to be used in algorithm field of AlgorithmIdentifier (e.g. in SubjectPublicKeyInfo.algorithm, Certificate.signatureAlgorithm, and SignerInfo.signatureAlgorithm) are: PkixCfrgCurves OBJECT IDENTIFIER ::= { 1 3 101 100 } id-Ed25519Signature OBJECT IDENTIFIER ::= { PkixCfrgCurves 1 } id-Ed25519phSignature OBJECT IDENTIFIER ::= { PkixCfrgCurves 2 } id-EcdhX25519 OBJECT IDENTIFIER ::= { PkixCfrgCurves 3 } id-Ed448Signature OBJECT IDENTIFIER ::= { PkixCfrgCurves 4 } id-Ed448phSignature OBJECT IDENTIFIER ::= { PkixCfrgCurves 5 } id-EcdhX448 OBJECT IDENTIFIER ::= { PkixCfrgCurves 6 } The parameters field MUST be absent (not NULL). That is, in wire form, these AlgorithmIdenfiers (including the SEQUENCE the in definition) are: - 30 06 06 04 2B 65 64 01 for Ed25519 - 30 06 06 04 2B 65 64 02 for Ed25519ph - 30 06 06 04 2B 65 64 03 for X25519 - 30 06 06 04 2B 65 64 04 for Ed448 - 30 06 06 04 2B 65 64 05 for Ed448ph - 30 06 06 04 2B 65 64 06 for X448 ---------------------------------------- The above probably needs some bikeshedding on the names and lots of editorial fixups. -Ilari From nobody Fri Jul 22 11:00:19 2016 Return-Path: X-Original-To: curdle@ietfa.amsl.com Delivered-To: curdle@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8B2F812DBD8 for ; Fri, 22 Jul 2016 11:00:17 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.922 X-Spam-Level: X-Spam-Status: No, score=-1.922 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H4=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=docusign2com.onmicrosoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id q_0SiYdL6awT for ; Fri, 22 Jul 2016 11:00:14 -0700 (PDT) Received: from NAM03-DM3-obe.outbound.protection.outlook.com (mail-dm3nam03on0092.outbound.protection.outlook.com [104.47.41.92]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 6117A12D7D9 for ; Fri, 22 Jul 2016 11:00:14 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=DOCUSIGN2COM.onmicrosoft.com; s=selector1-docusign-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=dwY5q12HFcOk0px7AZqLYPKTQAQ7MD8R1o1GpA0Sz3k=; b=Kfv5CwQVeIGIzW6f1Uha+yaozoaydVn92mbNEi/N3FQDf6mFn3E0m6U/hRjRXf0Cqv8kmOJivd7OjM/48k+JvdJaT8CkYkPL/o6O6Ca5B24N1axBVGIL6vBjsNpCca5SwHcb+lKlvjbWTO07QLpD+1yuxb1nqm5IRT1MgThw2Ic= Received: from BN3PR0401MB1395.namprd04.prod.outlook.com (10.161.209.154) by BN3PR0401MB1396.namprd04.prod.outlook.com (10.161.209.155) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id 15.1.544.10; Fri, 22 Jul 2016 18:00:11 +0000 Received: from BN3PR0401MB1395.namprd04.prod.outlook.com ([10.161.209.154]) by BN3PR0401MB1395.namprd04.prod.outlook.com ([10.161.209.154]) with mapi id 15.01.0544.017; Fri, 22 Jul 2016 18:00:11 +0000 From: Erwann Abalea To: Ilari Liusvaara Thread-Topic: [Curdle] draft-ietf-curdle-pkix-00: a simplification proposal Thread-Index: AQHR5ELk+yRC9yp5Q0G41cpW5aPpog== Date: Fri, 22 Jul 2016 18:00:11 +0000 Message-ID: <6F0EA612-DB5F-43A4-899C-36C2956B5D3F@docusign.com> References: <1463470661.2914.4.camel@redhat.com> <1463647224.3558.14.camel@redhat.com> <1553247361.41476124.1465542998520.JavaMail.zimbra@redhat.com> <015201d1caa9$ce55ac60$6b010520$@augustcellars.com> <2DD56D786E600F45AC6BDE7DA4E8A8C117F26424@eusaamb107.ericsson.se> <20160722113642.GA24793@LK-Perkele-V2.elisa-laajakaista.fi> In-Reply-To: <20160722113642.GA24793@LK-Perkele-V2.elisa-laajakaista.fi> Accept-Language: fr-FR, en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=Erwann.Abalea@docusign.com; x-ms-exchange-messagesentrepresentingtype: 1 x-originating-ip: [82.66.232.79] x-ms-office365-filtering-correlation-id: 0d09a03e-3e55-47aa-ff83-08d3b25a06bc x-microsoft-exchange-diagnostics: 1; BN3PR0401MB1396; 6:4rry0VdVin+iqFFEbXWBaJxoxnXCRq3hjLq6E7XBVgnwxF5nGFe8bP9GZIo4Iiw/TtedGQlBzAMWE9BAHTNFyTX4vX9U4GQ/bJ2HcWzSE0qwsTWIROHWpw3fboo9Sf6cedDcN9vxkUaJypWDDOWooLRScq2TSF8qTWYOCFiHhwCEnuusaveSJSAfYBxsp+LLew1gUo6M+DGhXMiYVT3ITfnSxoTERMUR5fV4S+aaF6ff2daRa0Em/thu77ak58CHpU1yFTNOEfpYeNonJvKBxRBC+GBWUXGVP/0Sv4TUUCM=; 5:+w9Te058sqxhi2GhIf7sd8QatUeqsS6oEBeNc/dEttHY3ge3jhDn8L8q6kIUD6mq49+3XU4PMjam5cCcmMdfzLxD+9VWfq7CH24Lr9WTIWIWyHJnrL5gZLA/ix7K0SXcJ0JxVrn/sGzQ8QlhkdlC1A==; 24:98Zhr23wQoCE1luK1QDXxOLQUgf0fUEd15gfv7TuJ/Vb0MCcnniMJBok7KkSIHr16WKKDEilAgA0s3CUJ3dsjGWssm4+9TcyQbv+B980O5g=; 7:jG7RmnHdp88U1oke4fGuQgGDwj9mgiLFhVTPQjaCh5g6hSTUXOWqaYHK26CSIwfAOVA+y4dzffjEbOsvrfIDwjfp3KlBF9ZYjmGS/GivBCMtPfx7frfrnWTTpA//EPesuCO/ZMw6TCW1rkWvuuRKTLT8czDdNvWH/anIlNnIrgUsCZKO9zdKqPYMObqmum/R4RqT2t6ByftfzwLg72vNxh9gUr0hedER+AJDxNNZEoFXzMbLx6aMyCZYqLoc+Q2m x-microsoft-antispam: UriScan:;BCL:0;PCL:0;RULEID:;SRVR:BN3PR0401MB1396; x-microsoft-antispam-prvs: x-exchange-antispam-report-test: UriScan:(100405760836317); x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(601004)(2401047)(5005006)(8121501046)(3002001)(10201501046); SRVR:BN3PR0401MB1396; BCL:0; PCL:0; RULEID:; SRVR:BN3PR0401MB1396; x-forefront-prvs: 0011612A55 x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(6009001)(7916002)(199003)(24454002)(189002)(36756003)(8936002)(87936001)(86362001)(3660700001)(68736007)(81156014)(81166006)(102836003)(15975445007)(6116002)(2900100001)(2950100001)(3846002)(586003)(8676002)(3280700002)(2906002)(110136002)(77096005)(11100500001)(97736004)(4326007)(105586002)(189998001)(99286002)(66066001)(54356999)(76176999)(19580395003)(230783001)(93886004)(101416001)(7736002)(92566002)(7846002)(122556002)(50986999)(82746002)(106116001)(106356001)(19580405001)(10400500002)(33656002)(5002640100001)(305945005)(83716003)(104396002); DIR:OUT; SFP:1102; SCL:1; SRVR:BN3PR0401MB1396; H:BN3PR0401MB1395.namprd04.prod.outlook.com; FPR:; SPF:None; PTR:InfoNoRecords; A:1; MX:1; LANG:en; received-spf: None (protection.outlook.com: docusign.com does not designate permitted sender hosts) spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: text/plain; charset="utf-8" Content-ID: <332EB5FCE68EAA4EA4B51F9456F85657@namprd04.prod.outlook.com> Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-OriginatorOrg: docusign.com X-MS-Exchange-CrossTenant-originalarrivaltime: 22 Jul 2016 18:00:11.5989 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 237e701c-327f-4cad-a5a1-dda2412d89d9 X-MS-Exchange-Transport-CrossTenantHeadersStamped: BN3PR0401MB1396 Archived-At: Cc: "curdle@ietf.org" , Daniel Migault Subject: Re: [Curdle] draft-ietf-curdle-pkix-00: a simplification proposal X-BeenThere: curdle@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "List for discussion of potential new security area wg." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 22 Jul 2016 18:00:17 -0000 Qm9uam91ciwNCg0KSGV4IGR1bXAgb2YgREVSIGVuY29kZWQgdGhpbmcgaXNu4oCZdCBuaWNlLg0K DQoNClVzaW5nIEFTTi4xIGFuZCBSRkM1OTEyIG1vZHVsZXM6DQoNCi0tIFdlIG5lZWQgdG8gY29u dGFjdCBUaGF3dGUgQ29uc3VsdGluZywgb3IgVmVyaXNpZ24sIG9yIHdob2V2ZXIgbm93IG93bnMg dGhlIDEuMy4xMDEgT0lEIGFyYywgYXMgT0lEIGhpamFja2luZyBpcyBub3QgYWxsb3dlZC4NCg0K LS0NCi0tIFB1YmxpYyBrZXkgdHlwZXMNCi0tDQoNCmlkLUVkRFNBUHVibGljS2V5IE9CSkVDVCBJ REVOVElGSUVSIDo6PSB7IGlzbygxKSBpZGVudGlmaWVkLW9yZ2FuaXphdGlvbigzKSB0aGF3dGUo MTAxKSAxMDAgfQ0KaWQtcGstRWQyNTUxOSBPQkpFQ1QgSURFTlRJRklFUiA6Oj0geyBpZC1FZERT QVB1YmxpY0tleSAxIH0NCmlkLXBrLUVkMjU1MTlwaCBPQkpFQ1QgSURFTlRJRklFUiA6Oj0geyBp ZC1FZERTQVB1YmxpY0tleSAyIH0NCmlkLXBrLVgyNTUxOSBPQkpFQ1QgSURFTlRJRklFUiA6Oj0g eyBpZC1FZERTQVB1YmxpY0tleSAzIH0NCmlkLXBrLUVkNDQ4IE9CSkVDVCBJREVOVElGSUVSIDo6 PSB7IGlkLUVkRFNBUHVibGljS2V5IDQgfQ0KaWQtcGstRWQ0NDhwaCBPQkpFQ1QgSURFTlRJRklF UiA6Oj0geyBpZC1FZERTQVB1YmxpY0tleSA1IH0NCmlkLXBrLVg0NDggT0JKRUNUIElERU5USUZJ RVIgOjo9IHsgaWQtRWREU0FQdWJsaWNLZXkgNiB9DQoNCiAtLSBFbmNvZGluZyBvZiB0aGUgZm9s bG93aW5nIHB1YmxpYyBrZXkgdHlwZXMgaXMgZGVmaW5lZCBpbiBkcmFmdC1pcnRmLWNmcmctZWRk c2ENCg0KcGstRWQyNTUxOSBQVUJMSUMtS0VZIDo6PSB7DQogIElERU5USUZJRVIgaWQtcGstRWQy NTUxOQ0KICBQQVJBTVMgVFlQRSBOVUxMIEFSRSBhYnNlbnQNCn0NCg0KcGstRWQyNTUxOXBoIFBV QkxJQy1LRVkgOjo9IHsNCiAgSURFTlRJRklFUiBpZC1way1FZDI1NTE5cGgNCiAgUEFSQU1TIFRZ UEUgTlVMTCBBUkUgYWJzZW50DQp9DQoNCnBrLVgyNTUxOSBQVUJMSUMtS0VZIDo6PSB7DQogIElE RU5USUZJRVIgaWQtcGstWDI1NTE5DQogIFBBUkFNUyBUWVBFIE5VTEwgQVJFIGFic2VudA0KfQ0K DQpway1FZDQ0OCBQVUJMSUMtS0VZIDo6PSB7DQogIElERU5USUZJRVIgaWQtcGstRWQ0NDgNCiAg UEFSQU1TIFRZUEUgTlVMTCBBUkUgYWJzZW50DQp9DQoNCnBrLUVkNDQ4cGggUFVCTElDLUtFWSA6 Oj0gew0KICBJREVOVElGSUVSIGlkLXBrLUVkNDQ4cGgNCiAgUEFSQU1TIFRZUEUgTlVMTCBBUkUg YWJzZW50DQp9DQoNCnBrLVg0NDggUFVCTElDLUtFWSA6Oj0gew0KICBJREVOVElGSUVSIGlkLXBr LVg0NDgNCiAgUEFSQU1TIFRZUEUgTlVMTCBBUkUgYWJzZW50DQp9DQoNClB1YmxpY0tleXMgUFVC TElDLUtFWSA6Oj0gew0KICAtLSBwcmV2aW91c2x5IGRlZmluZWQgcHVibGljIGtleSBhbGdvcml0 aG1zDQogIHwgcGstRWQyNTUxOQ0KICB8IHBrLUVkMjU1MTlwaA0KICB8IHBrLVgyNTUxOQ0KICB8 IHBrLUVkNDQ4DQogIHwgcGstRWQ0NDhwaA0KICB8IHBrLVg0NDgsDQogICAuLi4NCn0NCg0KDQot LQ0KLS0gU2lnbmF0dXJlIGFsZ29yaXRobXMNCi0tDQoNCmlkLUVkRFNBU2lnbmF0dXJlQWxnb3Jp dGhtIE9CSkVDVCBJREVOVElGSUVSIDo6PSB7IGlzbygxKSBpZGVudGlmaWVkLW9yZ2FuaXphdGlv bigzKSB0aGF3dGUoMTAxKSAxMDEgfQ0KLS0gSUlVQywgUnVzcyBIb3VzbGV5IHdhbnRzIGlkLUVk RFNBU2lnbmF0dXJlQWxnb3JpdGhtIHRvIGJlIGVxdWFsIHRvIGlkLUVkRFNBUHVibGljS2V5LiBJ ZiBpdOKAmXMgYWNjZXB0ZWQsIGp1c3QgY2hhbmdlIHRoZSBsYXN0IDEwMSBhYm92ZSBieSBhIDEw MC4NCg0KaWQtc2EtRWQyNTUxOSBPQkpFQ1QgSURFTlRJRklFUiA6Oj0geyBpZC1way1FZERTQVNp Z25hdHVyZUFsZ29yaXRobSAxIH0NCmlkLXNhLUVkMjU1MTlwaCBPQkpFQ1QgSURFTlRJRklFUiA6 Oj0geyBpZC1FZERTQVNpZ25hdHVyZUFsZ29yaXRobSAyIH0NCmlkLXNhLUVkNDQ4IE9CSkVDVCBJ REVOVElGSUVSIDo6PSB7IGlkLUVkRFNBU2lnbmF0dXJlQWxnb3JpdGhtIDQgfQ0KaWQtc2EtRWQ0 NDhwaCBPQkpFQ1QgSURFTlRJRklFUiA6Oj0geyBpZC1FZERTQVNpZ25hdHVyZUFsZ29yaXRobSA1 IH0NCg0KLS0gRW5jb2Rpbmcgb2YgdGhlIHNpZ25hdHVyZSB2YWx1ZSBmb3IgdGhlIGZvbGxvd2lu ZyBzaWduYXR1cmUgYWxnb3JpdGhtcyBpcyBkZWZpbmVkIGluIGRyYWZ0LWlydGYtY2ZyZy1lZGRz YQ0KDQpzYS1FZDI1NTE5IFNJR05BVFVSRS1BTEdPUklUSE0gOjo9IHsNCiAgSURFTlRJRklFUiBp ZC1zYS1FZDI1NTE5DQogIFBBUkFNUyBUWVBFIE5VTEwgQVJFIGFic2VudA0KICBQVUJMSUMtS0VZ UyB7IHBrLUVkMjU1MTkgfQ0KfQ0KDQpzYS1FZDI1NTE5cGggU0lHTkFUVVJFLUFMR09SSVRITSA6 Oj0gew0KICBJREVOVElGSUVSIGlkLXNhLUVkMjU1MTlwaA0KICBQQVJBTVMgVFlQRSBOVUxMIEFS RSBhYnNlbnQNCiAgUFVCTElDLUtFWVMgeyBway1FZDI1NTE5cGggfQ0KfQ0KDQpzYS1FZDQ0OCBT SUdOQVRVUkUtQUxHT1JJVEhNIDo6PSB7DQogIElERU5USUZJRVIgaWQtc2EtRWQ0NDgNCiAgUEFS QU1TIFRZUEUgTlVMTCBBUkUgYWJzZW50DQogIFBVQkxJQy1LRVlTIHsgcGstRWQ0NDggfQ0KfQ0K DQpzYS1FZDQ0OHBoIFNJR05BVFVSRS1BTEdPUklUSE0gOjo9IHsNCiAgSURFTlRJRklFUiBpZC1z YS1FZDQ0OA0KICBQQVJBTVMgVFlQRSBOVUxMIEFSRSBhYnNlbnQNCiAgUFVCTElDLUtFWVMgeyBw ay1FZDQ0OCB9DQp9DQoNClNpZ25hdHVyZUFsZ29yaXRobXMgU0lHTkFUVVJFLUFMR09SSVRITSA6 Oj0gew0KICAtLSBwcmV2aW91c2x5IGRlZmluZWQgYWxnb3JpdGhtcw0KICB8IHNhLUVkMjU1MTkN CiAgfCBzYS1FZDI1NTE5cGgNCiAgfCBzYS1FZDQ0OA0KICB8IHNhLUVkNDQ4cGgsDQogICAuLi4N Cn0NCg0KDQotLSBUaGUgZm9sbG93aW5nIHN0dWZmIGlzIHRvIGJlIGRpc2N1c3NlZCwgYmVjYXVz ZSB0aGVyZeKAmXMgbm8gdXNlIG9mIFgyNTUxOS80NDgga2V5cyBmb3Igbm93LCBhbmQgdGhleSBj b3VsZCBiZSB1c2VkIGluIENNUyAod2hpY2ggaXNu4oCZdCBQS0lYKS4NCg0KLS0NCi0tIEtleSBh Z3JlZW1lbnQgYWxnb3JpdGhtcw0KLS0NCg0KaWQtRWRYS2V5QWdyZWVtZW50QWxnb3JpdGhtIE9C SkVDVCBJREVOVElGSUVSIDo6PSB7IGlzbygxKSBpZGVudGlmaWVkLW9yZ2FuaXphdGlvbigzKSB0 aGF3dGUoMTAxKSAxMDIgfQ0KDQppZC1rYWEtWDI1NTE5IE9CSkVDVCBJREVOVElGSUVSIDo6PSB7 IGlkLXBrLUVkWEtleUFncmVlbWVudEFsZ29yaXRobSAxIH0NCmlkLWthYS1YNDQ4IE9CSkVDVCBJ REVOVElGSUVSIDo6PSB7IGlkLUVkWEtleUFncmVlbWVudEFsZ29yaXRobSAyIH0NCg0KLS0gRW5j b2Rpbmcgb2YgY3J5cHRvIG1hdGVyaWFsIGZvciB0aGUgZm9sbG93aW5nIGtleSBhZ3JlZW1lbnQg YWxnb3JpdGhtcyBpcyBkZWZpbmVkIGluID8/Pw0KDQprYWEtWDI1NTE5IEtFWS1BR1JFRSA6Oj0g ew0KICBJREVOVElGSUVSIGlkLWthYS1YMjU1MTkNCiAgUEFSQU1TIFRZUEUgTlVMTCBBUkUgYWJz ZW50DQogIFBVQkxJQy1LRVlTIHsgcGstWDI1NTE5IH0NCn0NCg0Ka2FhLVg0NDggS0VZLUFHUkVF IDo6PSB7DQogIElERU5USUZJRVIgaWQta2FhLVg0NDgNCiAgUEFSQU1TIFRZUEUgTlVMTCBBUkUg YWJzZW50DQogIFBVQkxJQy1LRVlTIHsgcGstWDQ0OCB9DQp9DQoNCmV0Y+KApg0KDQoNCkNvcmRp YWxlbWVudCwNCkVyd2FubiBBYmFsZWENCg0KPiBMZSAyMiBqdWlsLiAyMDE2IMOgIDEzOjM2LCBJ bGFyaSBMaXVzdmFhcmEgPGlsYXJpbGl1c3ZhYXJhQHdlbGhvLmNvbT4gYSDDqWNyaXQgOg0KPiAN Cj4gT24gU2F0LCBKdW4gMjUsIDIwMTYgYXQgMTE6NDk6MjVQTSAtMDQwMCwgQmVuamFtaW4gS2Fk dWsgd3JvdGU6DQo+PiBEYXZpZCBoYXMgYmFzaWNhbGx5IGNvbnZpbmNlZCBtZSBvZiB0aGUgc3Vw ZXJpb3JpdHkgb2YgdGhlICJvbmUgam9pbnQgYW5kDQo+PiBrZWVwIGl0IHdlbGwtb2lsZWQiIHBo aWxvc29waHkgKGkuZS4sIHRvcC1sZXZlbCBPSUQpIC0tIGl0J3MganVzdCB0b28gZWFzeQ0KPj4g Zm9yIGltcGxlbWVudGF0aW9ucyB0byBlbmQgdXAgZG9pbmcgYmFkIHRoaW5ncyB3aGVuIHRoZXJl IGFyZSBzZXBhcmF0ZQ0KPj4gcGFyYW1ldGVycyBpbnZvbHZlZC4NCj4gDQo+IFllYWgsIEkgdGhp bmsgc2VwYXJhdGUgdG9wLWxldmVsIE9JRCBzZWVtcyB0aGUgY2xlYW5lc3QuDQo+IA0KPiBGdXJ0 aGVybW9yZSwgSSBsaXN0ZW5lZCB0byB0aGUgbGFtcHMgc2Vzc2lvbiB0b2RheSwgYW5kIHRoZXkg YWdyZWVlZA0KPiAoc3Ryb25nIGNvbnNlbnN1cz8pIHRvIHNlbmQgcmVjb21tZWRhdGlvbiB0byBD VVJETEUgZm9yIHRoYXQgc2NoZW1lLg0KPiANCj4gDQo+IEFuZCBhcyBmb3Igb3RoZXIgcXVlc3Rp b25hYmxlIHJlYXNvbnMsIGl0IHdvdWxkIGFsc28gYmUgbW9yZSBjb21wYWN0DQo+IChhc3N1bWlu ZyB3ZSBjYW4gc3ViLU9JRCB0aGUgYXJjcywgd2hpY2ggSSB0aGluayB3ZSBjYW4pOiBGb3IgdXNp bmcNCj4gKzEgYnl0ZSBvbiBPSUQsIHdlIGNhbiBqZXR0aXNvbiBwYXJhbWV0ZXJzLCB3aGljaCBp cyAtMyBieXRlcywgZm9yDQo+IG5ldCBvZiAtMiBieXRlcy4gOi0pDQo+IA0KPiANCj4gTW9yZSBj b25jcmV0ZWx5Og0KPiANCj4gDQo+IFNvbWV0aGluZyBsaWtlIChpbiB3aXJlIGZvcm0gZm9yIFN1 YmplY3RQdWJsaWNLZXlJbmZvLmFsZ29yaXRobSk6DQo+IDMwIDA2IDA2IDA0IDJCIDY1IDY0IDAx ICAgICAgIEVkMjU1MTkNCj4gMzAgMDYgMDYgMDQgMkIgNjUgNjQgMDIgICAgICAgRWQyNTUxOXBo DQo+IDMwIDA2IDA2IDA0IDJCIDY1IDY0IDAzICAgICAgIFgyNTUxOQ0KPiAzMCAwNiAwNiAwNCAy QiA2NSA2NCAwNCAgICAgICBFZDQ0OA0KPiAzMCAwNiAwNiAwNCAyQiA2NSA2NCAwNSAgICAgICBF ZDQ0OHBoDQo+IDMwIDA2IDA2IDA0IDJCIDY1IDY0IDA2ICAgICAgIFg0NDgNCj4gDQo+IEFuZCB0 aGVuIGZvciBDZXJ0aWZpY2F0ZS5zaWduYXR1cmVBbGdvcml0aG06DQo+IDMwIDA2IDA2IDA0IDJC IDY1IDY0LzY1IDAxICAgICAgIEVkMjU1MTkNCj4gMzAgMDYgMDYgMDQgMkIgNjUgNjQvNjUgMDIg ICAgICAgRWQyNTUxOXBoDQo+IDMwIDA2IDA2IDA0IDJCIDY1IDY0LzY1IDA0ICAgICAgIEVkNDQ4 DQo+IDMwIDA2IDA2IDA0IDJCIDY1IDY0LzY1IDA1ICAgICAgIEVkNDQ4cGgNCj4gDQo+IA0KPiBX aGVyZSA2NCBvciA2NSBpcyBjaG9zZW4gYmFzZWQgb24gaWYgcmV1c2luZyB0aGUgT0lEIGlzIE9L ICg2NCkNCj4gb3Igbm90ICg2NSkuDQo+IA0KPiANCj4gVGhlbiBlLmcuIEVkMjU1MTkgU1BLSSB3 b3VsZCBiZSBlbmNvZGVkIGFzOg0KPiANCj4gMzAgMkIgMzAgMDYgMDYgMDQgMkIgNjUgNjQgMDEg MDMgMjEgMDAgPDMyIGJ5dGUgcHVia2V5Pg0KPiANCj4gDQo+IA0KPiAtSWxhcmkNCj4gDQo+IF9f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fDQo+IEN1cmRsZSBt YWlsaW5nIGxpc3QNCj4gQ3VyZGxlQGlldGYub3JnDQo+IGh0dHBzOi8vd3d3LmlldGYub3JnL21h aWxtYW4vbGlzdGluZm8vY3VyZGxlDQo+IA0KDQo= From nobody Fri Jul 22 11:18:36 2016 Return-Path: X-Original-To: curdle@ietfa.amsl.com Delivered-To: curdle@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4167B12D7B0 for ; Fri, 22 Jul 2016 11:18:35 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -3.187 X-Spam-Level: X-Spam-Status: No, score=-3.187 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RP_MATCHES_RCVD=-1.287] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id vc9KPfFAI9Rs for ; Fri, 22 Jul 2016 11:18:32 -0700 (PDT) Received: from welho-filter1.welho.com (welho-filter1.welho.com [83.102.41.23]) by ietfa.amsl.com (Postfix) with ESMTP id 4749B12D09A for ; Fri, 22 Jul 2016 11:18:31 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by welho-filter1.welho.com (Postfix) with ESMTP id 9E22A7A4; Fri, 22 Jul 2016 21:18:30 +0300 (EEST) X-Virus-Scanned: Debian amavisd-new at pp.htv.fi Received: from welho-smtp3.welho.com ([IPv6:::ffff:83.102.41.86]) by localhost (welho-filter1.welho.com [::ffff:83.102.41.23]) (amavisd-new, port 10024) with ESMTP id hq8k6vFboIic; Fri, 22 Jul 2016 21:18:30 +0300 (EEST) Received: from LK-Perkele-V2 (87-100-177-32.bb.dnainternet.fi [87.100.177.32]) (using TLSv1 with cipher ECDHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by welho-smtp3.welho.com (Postfix) with ESMTPSA id 5CFE22310; Fri, 22 Jul 2016 21:18:30 +0300 (EEST) Date: Fri, 22 Jul 2016 21:18:25 +0300 From: Ilari Liusvaara To: Erwann Abalea Message-ID: <20160722181825.GA26572@LK-Perkele-V2.elisa-laajakaista.fi> References: <1463647224.3558.14.camel@redhat.com> <1553247361.41476124.1465542998520.JavaMail.zimbra@redhat.com> <015201d1caa9$ce55ac60$6b010520$@augustcellars.com> <2DD56D786E600F45AC6BDE7DA4E8A8C117F26424@eusaamb107.ericsson.se> <20160722113642.GA24793@LK-Perkele-V2.elisa-laajakaista.fi> <6F0EA612-DB5F-43A4-899C-36C2956B5D3F@docusign.com> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline Content-Transfer-Encoding: 8bit In-Reply-To: <6F0EA612-DB5F-43A4-899C-36C2956B5D3F@docusign.com> User-Agent: Mutt/1.6.0 (2016-04-01) Sender: ilariliusvaara@welho.com Archived-At: Cc: "curdle@ietf.org" , Daniel Migault Subject: Re: [Curdle] draft-ietf-curdle-pkix-00: a simplification proposal X-BeenThere: curdle@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "List for discussion of potential new security area wg." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 22 Jul 2016 18:18:35 -0000 On Fri, Jul 22, 2016 at 06:00:11PM +0000, Erwann Abalea wrote: > Bonjour, > > Hex dump of DER encoded thing isn’t nice. > > > Using ASN.1 and RFC5912 modules: > > -- We need to contact Thawte Consulting, or Verisign, or whoever now > owns the 1.3.101 OID arc, as OID hijacking is not allowed. 1.3.101.100 was used in the IETF -00 draft. I think I heard it got allocated for EdDSA. > id-EdDSASignatureAlgorithm OBJECT IDENTIFIER ::= { iso(1) > identified-organization(3) thawte(101) 101 } LAMPS recommendation was to use the same identifiers for signatures and for keys. > id-EdXKeyAgreementAlgorithm OBJECT IDENTIFIER ::= { iso(1) > identified-organization(3) thawte(101) 102 } I don't know what 1.3.101.102 is... And besides, I have heard requests for a way of encoding X25519/X448 key as X.509 SPKI. -Ilari From nobody Fri Jul 22 11:47:50 2016 Return-Path: X-Original-To: curdle@ietfa.amsl.com Delivered-To: curdle@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6890212DF07 for ; Fri, 22 Jul 2016 11:47:49 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.922 X-Spam-Level: X-Spam-Status: No, score=-1.922 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H4=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=docusign2com.onmicrosoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id zrVviMyis9Qz for ; Fri, 22 Jul 2016 11:47:47 -0700 (PDT) Received: from NAM03-CO1-obe.outbound.protection.outlook.com (mail-co1nam03on0120.outbound.protection.outlook.com [104.47.40.120]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E307212E08E for ; Fri, 22 Jul 2016 11:47:46 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=DOCUSIGN2COM.onmicrosoft.com; s=selector1-docusign-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=szmro89t5JAzO3Ha/YCCCyRQDwU0E8KM3zk3BXr5SCE=; b=ZbkMiLJwtEan4IkzDYeQUlaH9foVDS4rt+5ZerrXFQhP2KqIgRAzQBqNcRZAx+9BvKwo36Qy1HJo9xWh1DeN7tnApWcJsQ+DUTupCyKcTaWSv9s20OVTDau1aT1mJfPmnMmgiWYu+zaoigw1CjqX7Rjam/JJsz4zqzRF8kVe5CA= Received: from BN3PR0401MB1395.namprd04.prod.outlook.com (10.161.209.154) by BN3PR0401MB1394.namprd04.prod.outlook.com (10.161.209.153) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id 15.1.544.10; Fri, 22 Jul 2016 18:47:45 +0000 Received: from BN3PR0401MB1395.namprd04.prod.outlook.com ([10.161.209.154]) by BN3PR0401MB1395.namprd04.prod.outlook.com ([10.161.209.154]) with mapi id 15.01.0544.017; Fri, 22 Jul 2016 18:47:44 +0000 From: Erwann Abalea To: Ilari Liusvaara Thread-Topic: [Curdle] draft-ietf-curdle-pkix-00: a simplification proposal Thread-Index: AQHR5ELk+yRC9yp5Q0G41cpW5aPpog== Date: Fri, 22 Jul 2016 18:47:43 +0000 Message-ID: <7C22F8A6-88C0-469F-8D4F-BCBF11922B11@docusign.com> References: <1463647224.3558.14.camel@redhat.com> <1553247361.41476124.1465542998520.JavaMail.zimbra@redhat.com> <015201d1caa9$ce55ac60$6b010520$@augustcellars.com> <2DD56D786E600F45AC6BDE7DA4E8A8C117F26424@eusaamb107.ericsson.se> <20160722113642.GA24793@LK-Perkele-V2.elisa-laajakaista.fi> <6F0EA612-DB5F-43A4-899C-36C2956B5D3F@docusign.com> <20160722181825.GA26572@LK-Perkele-V2.elisa-laajakaista.fi> In-Reply-To: <20160722181825.GA26572@LK-Perkele-V2.elisa-laajakaista.fi> Accept-Language: fr-FR, en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=Erwann.Abalea@docusign.com; x-ms-exchange-messagesentrepresentingtype: 1 x-originating-ip: [82.66.232.79] x-ms-office365-filtering-correlation-id: c74e5b1c-b366-490c-7bd4-08d3b260aadd x-microsoft-exchange-diagnostics: 1; BN3PR0401MB1394; 6:OrxArozSDy8/22VMCZeBmhDc58i587cBYANbEj5uukBPS8aKoeRx65CmaiUAXn2uFb338MbCAxZ6nyBFwZbF+LcG1CibJNBGlkAcAzKFY7fM/a+NQZ4S7IPFkKKJU8RG7Dinjw2t9kRk/4jdazlly11QV6a8q/ned5S/qjWdwARi55T/iEpeSoq+uuYdCcuvjoev90mSdCOJDmIjgBpsarepGoM5bJyRUNhccgiI8ISdpyfmjUO6pUPPId1F/ZL287k5xA81QNnI4XvplDrM8DlyCIwiJvvvKxnvRhCakz8=; 5:uij/3St2XnkeLbeu56FoDuDzE4dQ/rl7CDB69iF/jJD5JApsIo3803LNY7SufPk5sc8lMw3PZZmdtxIZ96nfnXb60uuVtk7DMWH1Xc3mEqAAtfYDy1CkqYEHm9mTT4OuFFMeBJg6Utg4XYdn4ec+EQ==; 24:Q9aMVB7pkut42WFDEWt7SYvMkoq+fSO2wym55KxcAFEU9JlrdJ0dsdpAVp9n6HzHfqjR2xFwQgtS2zwRIsRX92eNuT2HFTxoGltTusGwx3A=; 7:Ge6YQqaAI9AXFz6suju8Pat+8/PU2tx0SD2Kfpd83RZ+rLTjxydpH5bkvpcNBxeTOuBOq86K8/UIno7xIoWk3iifR5D2sbQVIPgcJ6yT/EqDVzup17bIj5onITKQ0nbjIa8/G9a2EWyMyqYC9ocgKjIXX5WdjMhHrFPlHT9BBsG0zdfwRqLL7PyDeRHYSzPRmt5Vi6sKUsKKpqOAUFfp8kNT5hB7dkJb9CfvFqUVQYyQf/H0liSazWLbX7ejdIqx x-microsoft-antispam: UriScan:;BCL:0;PCL:0;RULEID:;SRVR:BN3PR0401MB1394; x-microsoft-antispam-prvs: x-exchange-antispam-report-test: UriScan:; x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(601004)(2401047)(5005006)(8121501046)(3002001)(10201501046); SRVR:BN3PR0401MB1394; BCL:0; PCL:0; RULEID:; SRVR:BN3PR0401MB1394; x-forefront-prvs: 0011612A55 x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(6009001)(7916002)(24454002)(199003)(189002)(305945005)(8936002)(7846002)(7736002)(189998001)(82746002)(19580405001)(36756003)(2950100001)(5002640100001)(2900100001)(83716003)(92566002)(110136002)(97736004)(66066001)(106116001)(106356001)(19580395003)(99286002)(77096005)(105586002)(54356999)(122556002)(93886004)(230783001)(87936001)(101416001)(50986999)(86362001)(76176999)(8676002)(2906002)(102836003)(81156014)(81166006)(6116002)(3846002)(3660700001)(586003)(3280700002)(33656002)(10400500002)(4326007)(68736007)(104396002); DIR:OUT; SFP:1102; SCL:1; SRVR:BN3PR0401MB1394; H:BN3PR0401MB1395.namprd04.prod.outlook.com; FPR:; SPF:None; PTR:InfoNoRecords; A:1; MX:1; LANG:en; received-spf: None (protection.outlook.com: docusign.com does not designate permitted sender hosts) spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: text/plain; charset="utf-8" Content-ID: <60AF83A456D4E143A6D7171129C4CB06@namprd04.prod.outlook.com> Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-OriginatorOrg: docusign.com X-MS-Exchange-CrossTenant-originalarrivaltime: 22 Jul 2016 18:47:43.9836 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 237e701c-327f-4cad-a5a1-dda2412d89d9 X-MS-Exchange-Transport-CrossTenantHeadersStamped: BN3PR0401MB1394 Archived-At: Cc: "curdle@ietf.org" , Daniel Migault Subject: Re: [Curdle] draft-ietf-curdle-pkix-00: a simplification proposal X-BeenThere: curdle@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "List for discussion of potential new security area wg." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 22 Jul 2016 18:47:49 -0000 Qm9uc29pciwNCg0KPiBMZSAyMiBqdWlsLiAyMDE2IMOgIDIwOjE4LCBJbGFyaSBMaXVzdmFhcmEg PGlsYXJpbGl1c3ZhYXJhQHdlbGhvLmNvbT4gYSDDqWNyaXQgOg0KPiANCj4gT24gRnJpLCBKdWwg MjIsIDIwMTYgYXQgMDY6MDA6MTFQTSArMDAwMCwgRXJ3YW5uIEFiYWxlYSB3cm90ZToNCj4+IEJv bmpvdXIsDQo+PiANCj4+IEhleCBkdW1wIG9mIERFUiBlbmNvZGVkIHRoaW5nIGlzbuKAmXQgbmlj ZS4NCj4+IA0KPj4gDQo+PiBVc2luZyBBU04uMSBhbmQgUkZDNTkxMiBtb2R1bGVzOg0KPj4gDQo+ PiAtLSBXZSBuZWVkIHRvIGNvbnRhY3QgVGhhd3RlIENvbnN1bHRpbmcsIG9yIFZlcmlzaWduLCBv ciB3aG9ldmVyIG5vdw0KPj4gb3ducyB0aGUgMS4zLjEwMSBPSUQgYXJjLCBhcyBPSUQgaGlqYWNr aW5nIGlzIG5vdCBhbGxvd2VkLg0KPiANCj4gMS4zLjEwMS4xMDAgd2FzIHVzZWQgaW4gdGhlIElF VEYgLTAwIGRyYWZ0LiBJIHRoaW5rIEkgaGVhcmQgaXQgZ290DQo+IGFsbG9jYXRlZCBmb3IgRWRE U0EuDQoNCkkgaGF2ZW7igJl0IGZvdW5kIGFuIGF1dGhvcml0YXRpdmUgc291cmNlIGZvciB0aGlz Lg0KSXTigJlzIG5vdCB0aGUgZmlyc3QgdGltZSwgMS4zLjYgYmVsb25ncyB0byBEb0QsIGJ1dCAx LjMuNi4xIHdhcyDCqyBzZWxmLWFsbG9jYXRlZCDCuyBpbiBSRkMxMDY1Lg0KDQo+PiBpZC1FZERT QVNpZ25hdHVyZUFsZ29yaXRobSBPQkpFQ1QgSURFTlRJRklFUiA6Oj0geyBpc28oMSkNCj4+IGlk ZW50aWZpZWQtb3JnYW5pemF0aW9uKDMpIHRoYXd0ZSgxMDEpIDEwMSB9DQo+IA0KPiBMQU1QUyBy ZWNvbW1lbmRhdGlvbiB3YXMgdG8gdXNlIHRoZSBzYW1lIGlkZW50aWZpZXJzIGZvciBzaWduYXR1 cmVzDQo+IGFuZCBmb3Iga2V5cy4NCg0KVGhhdOKAmXMgd2hhdCBJIHJlYWQgbGF0ZXIuIFlvdSBj YW4gZWl0aGVyIGtlZXAgdGhlIG5hbWUgYnV0IHJldXNlIHRoZSBPSUQsIG9yIHJlbW92ZSB0aGUg aWQtc2EtKiBPSURzIGFuZCBjaGFuZ2UgdGhlIHNhLSogYWxnb3JpdGhtcyB0byB1c2UgdGhlIGlk LXBrLUVkKiBPSURzLg0KDQo+PiBpZC1FZFhLZXlBZ3JlZW1lbnRBbGdvcml0aG0gT0JKRUNUIElE RU5USUZJRVIgOjo9IHsgaXNvKDEpDQo+PiBpZGVudGlmaWVkLW9yZ2FuaXphdGlvbigzKSB0aGF3 dGUoMTAxKSAxMDIgfQ0KPiANCj4gSSBkb24ndCBrbm93IHdoYXQgMS4zLjEwMS4xMDIgaXPigKYN Cg0KVGhhdOKAmXMgd2h5IHRoZXJl4oCZcyBhIGNvbW1lbnRhcnkgc2F5aW5nIGl0IG5lZWRzIHRv IGJlIGRpc2N1c3NlZC4NCnNhLUVkKiBtYWtlIHVzZSBvZiB0aGUgcGstRWQqIGtleXMuDQpUaGVy ZeKAmXMgbm8gZGVmaW5lZCB1c2Ugb2YgcGstWCoga2V5cywgYW5kIHRoZXnigJlyZSB1c2VkIGZv ciBrZXkgYWdyZWVtZW50Lg0KDQpTaW5jZSBpbiB0aGUgbWVzc2FnZSBJIHJlcGxpZWQgdG8sIHlv dSBwcm9wb3NlZCB0aGUgZm9sbG93aW5nIERFUiBlbmNvZGVkIHNpZ2FsZzoNCjMwIDA2IDA2IDA0 IDJCIDY1IDY0LzY1IDAxICAgICAgIEVkMjU1MTkNCkl0IHNlZW1lZCB5b3Ugd2FudGVkIHRvIHVz ZSAxLjMuMTAxLjEwMSBmb3Igc2lnbmF0dXJlIGFsZ29yaXRobXMsIHNvIEkgZXhwYW5kZWQgdG8g MS4zLjEwMS4xMDIgZm9yIGtleSBhZ3JlZW1lbnQgYWxnb3JpdGhtcy4NCkJ1dCBhZ2FpbiwgaXTi gJlzIGEgc3ViamVjdCBvZiBkaXNjdXNzaW9uLg0KDQo+IEFuZCBiZXNpZGVzLCBJIGhhdmUgaGVh cmQgcmVxdWVzdHMgZm9yIGEgd2F5IG9mIGVuY29kaW5nIFgyNTUxOS9YNDQ4IGtleQ0KPiBhcyBY LjUwOSBTUEtJLg0KDQpUaGUgcHJvcG9zZWQgbW9kdWxlIGRvZXMganVzdCB0aGF04oCmDQoNCkl0 4oCZcyBub3QgbWFuZGF0b3J5IHRvIGhhdmUgYW4gQVNOLjEgZW5jb2RlZCB2YWx1ZSBpbiB0aGUg QklUIFNUUklORywgYnV0IGlmIHlvdSB3YW50IHRvIGRlZmluZSBvbmUsIGZlZWwgZnJlZS4= From nobody Fri Jul 22 13:08:44 2016 Return-Path: X-Original-To: curdle@ietfa.amsl.com Delivered-To: curdle@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A789F12E0FB for ; Fri, 22 Jul 2016 13:08:42 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -3.187 X-Spam-Level: X-Spam-Status: No, score=-3.187 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RP_MATCHES_RCVD=-1.287] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id nEyTVee4zF66 for ; Fri, 22 Jul 2016 13:08:40 -0700 (PDT) Received: from welho-filter2.welho.com (welho-filter2.welho.com [83.102.41.24]) by ietfa.amsl.com (Postfix) with ESMTP id 7A3D512E119 for ; Fri, 22 Jul 2016 13:08:37 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by welho-filter2.welho.com (Postfix) with ESMTP id 66BBB859E; Fri, 22 Jul 2016 23:08:35 +0300 (EEST) X-Virus-Scanned: Debian amavisd-new at pp.htv.fi Received: from welho-smtp2.welho.com ([IPv6:::ffff:83.102.41.85]) by localhost (welho-filter2.welho.com [::ffff:83.102.41.24]) (amavisd-new, port 10024) with ESMTP id FDBUcxU6fD0n; Fri, 22 Jul 2016 23:08:35 +0300 (EEST) Received: from LK-Perkele-V2 (87-100-177-32.bb.dnainternet.fi [87.100.177.32]) (using TLSv1 with cipher ECDHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by welho-smtp2.welho.com (Postfix) with ESMTPSA id 24D4621C; Fri, 22 Jul 2016 23:08:35 +0300 (EEST) Date: Fri, 22 Jul 2016 23:08:30 +0300 From: Ilari Liusvaara To: Erwann Abalea Message-ID: <20160722200830.GA26782@LK-Perkele-V2.elisa-laajakaista.fi> References: <1553247361.41476124.1465542998520.JavaMail.zimbra@redhat.com> <015201d1caa9$ce55ac60$6b010520$@augustcellars.com> <2DD56D786E600F45AC6BDE7DA4E8A8C117F26424@eusaamb107.ericsson.se> <20160722113642.GA24793@LK-Perkele-V2.elisa-laajakaista.fi> <6F0EA612-DB5F-43A4-899C-36C2956B5D3F@docusign.com> <20160722181825.GA26572@LK-Perkele-V2.elisa-laajakaista.fi> <7C22F8A6-88C0-469F-8D4F-BCBF11922B11@docusign.com> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline Content-Transfer-Encoding: 8bit In-Reply-To: <7C22F8A6-88C0-469F-8D4F-BCBF11922B11@docusign.com> User-Agent: Mutt/1.6.0 (2016-04-01) Sender: ilariliusvaara@welho.com Archived-At: Cc: "curdle@ietf.org" , Daniel Migault Subject: Re: [Curdle] draft-ietf-curdle-pkix-00: a simplification proposal X-BeenThere: curdle@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "List for discussion of potential new security area wg." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 22 Jul 2016 20:08:42 -0000 On Fri, Jul 22, 2016 at 06:47:43PM +0000, Erwann Abalea wrote: > Bonsoir, > > > Le 22 juil. 2016 à 20:18, Ilari Liusvaara a écrit : > > > > On Fri, Jul 22, 2016 at 06:00:11PM +0000, Erwann Abalea wrote: > >> Bonjour, > >> > >> Hex dump of DER encoded thing isn’t nice. > >> > >> > >> Using ASN.1 and RFC5912 modules: > >> > >> -- We need to contact Thawte Consulting, or Verisign, or whoever now > >> owns the 1.3.101 OID arc, as OID hijacking is not allowed. > > > > 1.3.101.100 was used in the IETF -00 draft. I think I heard it got > > allocated for EdDSA. > > I haven’t found an authoritative source for this. > It’s not the first time, 1.3.6 belongs to DoD, but 1.3.6.1 was « self-allocated » in RFC1065. Didn't find anything authoritative, but I did find that Simon switched to that OID (from much longer one) in persoal -02 draft. > >> id-EdXKeyAgreementAlgorithm OBJECT IDENTIFIER ::= { iso(1) > >> identified-organization(3) thawte(101) 102 } > > > > I don't know what 1.3.101.102 is… > > That’s why there’s a commentary saying it needs to be discussed. > sa-Ed* make use of the pk-Ed* keys. > There’s no defined use of pk-X* keys, and they’re used for key agreement. X.509 SPKI is used for more purposes than just X.509. > Since in the message I replied to, you proposed the following DER encoded sigalg: > 30 06 06 04 2B 65 64/65 01 Ed25519 > It seemed you wanted to use 1.3.101.101 for signature algorithms, so I expanded to 1.3.101.102 for key agreement algorithms. > But again, it’s a subject of discussion. Back when I wrote that, I had missed that reuse is OK. And as I noted then one should use those 64 values. -Ilari From nobody Fri Jul 22 13:54:25 2016 Return-Path: X-Original-To: curdle@ietfa.amsl.com Delivered-To: curdle@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3096812B01D for ; Fri, 22 Jul 2016 13:54:24 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.2 X-Spam-Level: X-Spam-Status: No, score=-4.2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id VBrioTHckQJG for ; Fri, 22 Jul 2016 13:54:20 -0700 (PDT) Received: from mmextmx1.mcr.colo.comodoca.net (mmextmx1.mcr.colo.comodoca.net [IPv6:2a02:1788:402:c00::c0a8:9cd5]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id ECB0312D629 for ; Fri, 22 Jul 2016 13:54:19 -0700 (PDT) Received: (qmail 1889 invoked by uid 1004); 22 Jul 2016 20:54:17 -0000 Received: from ian.brad.office.comodo.net (HELO ian.brad.office.comodo.net) (192.168.0.202) by mmextmx1.mcr.colo.comodoca.net (qpsmtpd/0.84) with ESMTP; Fri, 22 Jul 2016 21:54:17 +0100 Received: (qmail 19959 invoked by uid 1000); 22 Jul 2016 20:54:16 -0000 Received: from and0004.comodo.net (HELO [192.168.0.58]) (192.168.0.58) (smtp-auth username rob, mechanism plain) by ian.brad.office.comodo.net (qpsmtpd/0.40) with (AES128-SHA encrypted) ESMTPSA; Fri, 22 Jul 2016 21:54:16 +0100 To: Ilari Liusvaara , Erwann Abalea References: <1553247361.41476124.1465542998520.JavaMail.zimbra@redhat.com> <015201d1caa9$ce55ac60$6b010520$@augustcellars.com> <2DD56D786E600F45AC6BDE7DA4E8A8C117F26424@eusaamb107.ericsson.se> <20160722113642.GA24793@LK-Perkele-V2.elisa-laajakaista.fi> <6F0EA612-DB5F-43A4-899C-36C2956B5D3F@docusign.com> <20160722181825.GA26572@LK-Perkele-V2.elisa-laajakaista.fi> <7C22F8A6-88C0-469F-8D4F-BCBF11922B11@docusign.com> <20160722200830.GA26782@LK-Perkele-V2.elisa-laajakaista.fi> From: Rob Stradling Message-ID: <2647b6bd-e756-92e8-bf54-cdf9b0588fbc@comodo.com> Date: Fri, 22 Jul 2016 21:54:16 +0100 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Thunderbird/45.2.0 MIME-Version: 1.0 In-Reply-To: <20160722200830.GA26782@LK-Perkele-V2.elisa-laajakaista.fi> Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 8bit Archived-At: Cc: "curdle@ietf.org" , Daniel Migault Subject: Re: [Curdle] draft-ietf-curdle-pkix-00: a simplification proposal X-BeenThere: curdle@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "List for discussion of potential new security area wg." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 22 Jul 2016 20:54:24 -0000 On 22/07/16 21:08, Ilari Liusvaara wrote: >>>> Using ASN.1 and RFC5912 modules: >>>> >>>> -- We need to contact Thawte Consulting, or Verisign, or whoever now >>>> owns the 1.3.101 OID arc, as OID hijacking is not allowed. >>> >>> 1.3.101.100 was used in the IETF -00 draft. I think I heard it got >>> allocated for EdDSA. >> >> I haven’t found an authoritative source for this. >> It’s not the first time, 1.3.6 belongs to DoD, but 1.3.6.1 was « self-allocated » in RFC1065. > > Didn't find anything authoritative, but I did find that Simon > switched to that OID (from much longer one) in persoal -02 draft. Symantec own Thawte. I persuaded Symantec to offer to reserve/delegate a range of OIDs under 1.3.101 for EdDSA (see [1]). Simon accepted the offer and provisionally allocated some OIDs (see [2]). After further discussion (private email exchange between Simon, myself and Rick Andrews) it was decided to start the OID range at 1.3.101.100. This was for two reasons: 1) to avoid clashing with any OIDs that Thawte Consulting might have allocated many years ago. For example, I found evidence that 1.3.101.1.4 and 1.3.101.1.4.1 had been allocated previously. 2) because the printable ASCII for the DER encoding of these OIDs is, frankly, irresistable (see [3]). :-) It's not clear from my records if Rick reserved/delegated 1.3.101.100...1.3.101.115 or 1.3.101.100..1.3.101.127 for EdDSA. It won't be hard to clarify that with Symantec though. Please don't use any 1.3.101.x.y OIDs until we've run out of 1.3.101.x OIDs. There's no point wasting bytes. [1] https://www.ietf.org/mail-archive/web/tls/current/msg16798.html [2] https://www.ietf.org/mail-archive/web/tls/current/msg16835.html [3] https://www.ietf.org/mail-archive/web/tls/current/msg16586.html >>>> id-EdXKeyAgreementAlgorithm OBJECT IDENTIFIER ::= { iso(1) >>>> identified-organization(3) thawte(101) 102 } >>> >>> I don't know what 1.3.101.102 is… >> >> That’s why there’s a commentary saying it needs to be discussed. >> sa-Ed* make use of the pk-Ed* keys. >> There’s no defined use of pk-X* keys, and they’re used for key agreement. > > X.509 SPKI is used for more purposes than just X.509. > >> Since in the message I replied to, you proposed the following DER encoded sigalg: >> 30 06 06 04 2B 65 64/65 01 Ed25519 >> It seemed you wanted to use 1.3.101.101 for signature algorithms, so I expanded to 1.3.101.102 for key agreement algorithms. >> But again, it’s a subject of discussion. > > Back when I wrote that, I had missed that reuse is OK. And as I noted > then one should use those 64 values. > > > > -Ilari > > _______________________________________________ > Curdle mailing list > Curdle@ietf.org > https://www.ietf.org/mailman/listinfo/curdle > -- Rob Stradling Senior Research & Development Scientist COMODO - Creating Trust Online Office Tel: +44.(0)1274.730505 Office Fax: +44.(0)1274.730909 www.comodo.com COMODO CA Limited, Registered in England No. 04058690 Registered Office: 3rd Floor, 26 Office Village, Exchange Quay, Trafford Road, Salford, Manchester M5 3EQ This e-mail and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the sender by replying to the e-mail containing this attachment. Replies to this email may be monitored by COMODO for operational or business reasons. Whilst every endeavour is taken to ensure that e-mails are free from viruses, no liability can be accepted and the recipient is requested to use their own virus checking software. From nobody Fri Jul 22 14:02:13 2016 Return-Path: X-Original-To: curdle@ietfa.amsl.com Delivered-To: curdle@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A878C12D8F1 for ; Fri, 22 Jul 2016 14:02:11 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -3.187 X-Spam-Level: X-Spam-Status: No, score=-3.187 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RP_MATCHES_RCVD=-1.287] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id gz6raR5BmDnK for ; Fri, 22 Jul 2016 14:02:09 -0700 (PDT) Received: from welho-filter2.welho.com (welho-filter2.welho.com [83.102.41.24]) by ietfa.amsl.com (Postfix) with ESMTP id CF0E112D50C for ; Fri, 22 Jul 2016 14:02:08 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by welho-filter2.welho.com (Postfix) with ESMTP id EACAB855E; Sat, 23 Jul 2016 00:02:07 +0300 (EEST) X-Virus-Scanned: Debian amavisd-new at pp.htv.fi Received: from welho-smtp2.welho.com ([IPv6:::ffff:83.102.41.85]) by localhost (welho-filter2.welho.com [::ffff:83.102.41.24]) (amavisd-new, port 10024) with ESMTP id W2DDkwb8zJ63; Sat, 23 Jul 2016 00:02:07 +0300 (EEST) Received: from LK-Perkele-V2 (87-100-177-32.bb.dnainternet.fi [87.100.177.32]) (using TLSv1 with cipher ECDHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by welho-smtp2.welho.com (Postfix) with ESMTPSA id 81C6221C; Sat, 23 Jul 2016 00:02:07 +0300 (EEST) Date: Sat, 23 Jul 2016 00:02:03 +0300 From: Ilari Liusvaara To: Rob Stradling Message-ID: <20160722210202.GA30680@LK-Perkele-V2.elisa-laajakaista.fi> References: <015201d1caa9$ce55ac60$6b010520$@augustcellars.com> <2DD56D786E600F45AC6BDE7DA4E8A8C117F26424@eusaamb107.ericsson.se> <20160722113642.GA24793@LK-Perkele-V2.elisa-laajakaista.fi> <6F0EA612-DB5F-43A4-899C-36C2956B5D3F@docusign.com> <20160722181825.GA26572@LK-Perkele-V2.elisa-laajakaista.fi> <7C22F8A6-88C0-469F-8D4F-BCBF11922B11@docusign.com> <20160722200830.GA26782@LK-Perkele-V2.elisa-laajakaista.fi> <2647b6bd-e756-92e8-bf54-cdf9b0588fbc@comodo.com> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline In-Reply-To: <2647b6bd-e756-92e8-bf54-cdf9b0588fbc@comodo.com> User-Agent: Mutt/1.6.0 (2016-04-01) Sender: ilariliusvaara@welho.com Archived-At: Cc: "curdle@ietf.org" , Erwann Abalea , Daniel Migault Subject: Re: [Curdle] draft-ietf-curdle-pkix-00: a simplification proposal X-BeenThere: curdle@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "List for discussion of potential new security area wg." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 22 Jul 2016 21:02:12 -0000 On Fri, Jul 22, 2016 at 09:54:16PM +0100, Rob Stradling wrote: > > It's not clear from my records if Rick reserved/delegated > 1.3.101.100...1.3.101.115 or 1.3.101.100..1.3.101.127 for EdDSA. It won't > be hard to clarify that with Symantec though. Well, we go by LAMPS recommedations, we need 6 OIDs. And good to know we have more than 2 OIDs.... > Please don't use any 1.3.101.x.y OIDs until we've run out of 1.3.101.x OIDs. > There's no point wasting bytes. :-) -Ilari From nobody Fri Jul 22 14:31:26 2016 Return-Path: X-Original-To: curdle@ietfa.amsl.com Delivered-To: curdle@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E4C9B12D598 for ; Fri, 22 Jul 2016 14:31:24 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.2 X-Spam-Level: X-Spam-Status: No, score=-4.2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id quYEs2mGVfyR for ; Fri, 22 Jul 2016 14:31:22 -0700 (PDT) Received: from mmextmx1.mcr.colo.comodoca.net (mmextmx1.mcr.colo.comodoca.net [IPv6:2a02:1788:402:c00::c0a8:9cd5]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 972BA12D8DA for ; Fri, 22 Jul 2016 14:31:18 -0700 (PDT) Received: (qmail 3569 invoked by uid 1004); 22 Jul 2016 21:31:16 -0000 Received: from ian.brad.office.comodo.net (HELO ian.brad.office.comodo.net) (192.168.0.202) by mmextmx1.mcr.colo.comodoca.net (qpsmtpd/0.84) with ESMTP; Fri, 22 Jul 2016 22:31:16 +0100 Received: (qmail 22306 invoked by uid 1000); 22 Jul 2016 21:31:16 -0000 Received: from and0004.comodo.net (HELO [192.168.0.58]) (192.168.0.58) (smtp-auth username rob, mechanism plain) by ian.brad.office.comodo.net (qpsmtpd/0.40) with (AES128-SHA encrypted) ESMTPSA; Fri, 22 Jul 2016 22:31:16 +0100 To: Ilari Liusvaara References: <015201d1caa9$ce55ac60$6b010520$@augustcellars.com> <2DD56D786E600F45AC6BDE7DA4E8A8C117F26424@eusaamb107.ericsson.se> <20160722113642.GA24793@LK-Perkele-V2.elisa-laajakaista.fi> <6F0EA612-DB5F-43A4-899C-36C2956B5D3F@docusign.com> <20160722181825.GA26572@LK-Perkele-V2.elisa-laajakaista.fi> <7C22F8A6-88C0-469F-8D4F-BCBF11922B11@docusign.com> <20160722200830.GA26782@LK-Perkele-V2.elisa-laajakaista.fi> <2647b6bd-e756-92e8-bf54-cdf9b0588fbc@comodo.com> <20160722210202.GA30680@LK-Perkele-V2.elisa-laajakaista.fi> From: Rob Stradling Message-ID: Date: Fri, 22 Jul 2016 22:31:16 +0100 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Thunderbird/45.2.0 MIME-Version: 1.0 In-Reply-To: <20160722210202.GA30680@LK-Perkele-V2.elisa-laajakaista.fi> Content-Type: text/plain; charset=windows-1252; format=flowed Content-Transfer-Encoding: 7bit Archived-At: Cc: "curdle@ietf.org" , Erwann Abalea , Daniel Migault Subject: Re: [Curdle] draft-ietf-curdle-pkix-00: a simplification proposal X-BeenThere: curdle@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "List for discussion of potential new security area wg." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 22 Jul 2016 21:31:25 -0000 On 22/07/16 22:02, Ilari Liusvaara wrote: > On Fri, Jul 22, 2016 at 09:54:16PM +0100, Rob Stradling wrote: >> >> It's not clear from my records if Rick reserved/delegated >> 1.3.101.100...1.3.101.115 or 1.3.101.100..1.3.101.127 for EdDSA. It won't >> be hard to clarify that with Symantec though. > > Well, we go by LAMPS recommedations, we need 6 OIDs. From the raw minutes: "David Benjamin's proposal: 3 OIDs per curve: ECDH (25519 & 448); EdDSA (no PH); EdDSAph ... *** A hum to recommend David Benjamin's proposal was unanimously yes." IIUC, this is what's required... 1.3.101.100 ECDH 25519 1.3.101.101 EdDSA (no PH) 25519 1.3.101.102 EdDSAph 25519 1.3.101.103 ECDH 448 1.3.101.104 EdDSA (no PH) 448 1.3.101.105 EdDSAph 448 Is that right? -- Rob Stradling Senior Research & Development Scientist COMODO - Creating Trust Online From nobody Fri Jul 22 16:56:31 2016 Return-Path: X-Original-To: curdle@ietfa.amsl.com Delivered-To: curdle@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B843E12DD69 for ; Fri, 22 Jul 2016 16:56:30 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.922 X-Spam-Level: X-Spam-Status: No, score=-1.922 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H4=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=docusign2com.onmicrosoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id M1AvZ5znPOiQ for ; Fri, 22 Jul 2016 16:56:28 -0700 (PDT) Received: from NAM02-BL2-obe.outbound.protection.outlook.com (mail-bl2nam02on0103.outbound.protection.outlook.com [104.47.38.103]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 50E2212DA96 for ; Fri, 22 Jul 2016 16:56:28 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=DOCUSIGN2COM.onmicrosoft.com; s=selector1-docusign-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=sGV9pav00SXb0UyXtpF03kD1wpTX98RRu163SVyyOY8=; b=nAg+yhZ3rQmIx93kA4etUisAm/XOUotSuYQcMRoyzAg80fbPelHRj5YIqSknKr4kUUyzLCOltfAhCVN2l0Uudg1Nw3zntGH2GLz+troppCCB0QCMjD9s2vH27xrf4wwVHGDRrgj3IVKzbycGaAHgmcG1xo2GE9vrRtn39OqoV10= Received: from BN3PR0401MB1395.namprd04.prod.outlook.com (10.161.209.154) by BN3PR0401MB1395.namprd04.prod.outlook.com (10.161.209.154) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id 15.1.544.10; Fri, 22 Jul 2016 23:56:24 +0000 Received: from BN3PR0401MB1395.namprd04.prod.outlook.com ([10.161.209.154]) by BN3PR0401MB1395.namprd04.prod.outlook.com ([10.161.209.154]) with mapi id 15.01.0544.017; Fri, 22 Jul 2016 23:56:24 +0000 From: Erwann Abalea To: Ilari Liusvaara Thread-Topic: [Curdle] Proposal: Disallow Ed25519ph/Ed448ph for CA certificates Thread-Index: AQHR5HSnwtzIDE9gxE6vlh6a6SH73w== Date: Fri, 22 Jul 2016 23:56:24 +0000 Message-ID: <1B4F487E-7350-4B91-A63C-3F39857C8884@docusign.com> References: <19075EB00EA7FE49AFF87E5818D673D4138D60C7@PRODEXMB01W.eagle.usaa.com> <20160722160216.GA26177@LK-Perkele-V2.elisa-laajakaista.fi> In-Reply-To: <20160722160216.GA26177@LK-Perkele-V2.elisa-laajakaista.fi> Accept-Language: fr-FR, en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=Erwann.Abalea@docusign.com; x-ms-exchange-messagesentrepresentingtype: 1 x-originating-ip: [2a01:e35:242e:84f0:6550:b976:e5:e58] x-ms-office365-filtering-correlation-id: 9ad3eeeb-c7a4-4fa6-297d-08d3b28bca0d x-microsoft-exchange-diagnostics: 1; BN3PR0401MB1395; 6:BuZUO8jiEAeySk7HhZi7wAZ5GikZ0AQgLihED6vMUCcq4vxrauMHYUqgtt+je6WxkhTk8zud2Nm50HNnmXEXScBJOHRgFib1cP4T07bgLoGrF9QgVF42bmow0Xe7HZbY8LMsptKibb2uJGUFvT12HFZch1v/w5WPA415rcQ/3aernBYKK4XvcUQ6lMD+at4JBOI+y0YRA/Il8PAWobWm8hjL4JKyWbe7AFlJWOw6nV2X9h6WZlKj7Rvxl/Q2VvnxX/bXJaWlNwnumQN2kAE6XSLgFUwKbpwb5wzeiPsA5SM=; 5:En799WDAlNAnjTwbBoZz4zTpEtJGARFciY+dgukWEidRWCBeC1UiI/XJiHJyZKYrvUsiBmJfkbvTvGn5AHwl8AtWIFuddy1vHy1Rpr8+fDuZ9sLuJUnxD9rCy6dey/yQ5uysiRk0A+v/W1dxwWTLkQ==; 24:Q/MvqZzV48xYxyIpvvQ/be1tOU4u3uJ6AVkpPzyINn/yZbao1MtljJ84Xl+x3yoTSpQMJshZMre3ePTFoXxi18T51BoYhGTsUsLB5eTTxe4=; 7:ld5tyDfwiQWh1Tp19tAeeTjyC67pmTdFBT6T2jH0xgO1Zh3hjkQ9zYpbIe3CIIgSUetpKzmzjkt4Urz35yDyX/fFiRx7GlYHjBRwuarhLRz1EUgil1F6I41qKJ4z6YZq18hfkjpLrwVIljkl4ihSRbCOXWz/GmoIM1hYZlt9p6QZpq7k3bkjCuzzgeec1N8bc9Aak/SsvDdc/PuPXL84sXGbsKt9RH0lEpXFivDfoc+8sni3P0o4AWIBi/HIT4Dn x-microsoft-antispam: UriScan:;BCL:0;PCL:0;RULEID:;SRVR:BN3PR0401MB1395; x-microsoft-antispam-prvs: x-exchange-antispam-report-test: UriScan:; x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(601004)(2401047)(8121501046)(5005006)(10201501046)(3002001); SRVR:BN3PR0401MB1395; BCL:0; PCL:0; RULEID:; SRVR:BN3PR0401MB1395; x-forefront-prvs: 0011612A55 x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(6009001)(7916002)(53754006)(189002)(199003)(24454002)(110136002)(101416001)(97736004)(83716003)(122556002)(105586002)(86362001)(87936001)(99286002)(189998001)(76176999)(54356999)(50986999)(68736007)(4326007)(5002640100001)(77096005)(2906002)(81156014)(81166006)(19580395003)(11100500001)(3660700001)(19580405001)(3280700002)(33656002)(8936002)(92566002)(106116001)(7736002)(7846002)(10400500002)(106356001)(36756003)(2900100001)(305945005)(82746002)(2950100001)(586003)(6116002)(102836003)(3826002)(104396002); DIR:OUT; SFP:1102; SCL:1; SRVR:BN3PR0401MB1395; H:BN3PR0401MB1395.namprd04.prod.outlook.com; FPR:; SPF:None; PTR:InfoNoRecords; MX:1; A:1; LANG:en; received-spf: None (protection.outlook.com: docusign.com does not designate permitted sender hosts) spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: text/plain; charset="utf-8" Content-ID: <9B3E1B0D8672F141BEF6712297469FEB@namprd04.prod.outlook.com> Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-OriginatorOrg: docusign.com X-MS-Exchange-CrossTenant-originalarrivaltime: 22 Jul 2016 23:56:24.6448 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 237e701c-327f-4cad-a5a1-dda2412d89d9 X-MS-Exchange-Transport-CrossTenantHeadersStamped: BN3PR0401MB1395 Archived-At: Cc: "curdle@ietf.org" Subject: Re: [Curdle] Proposal: Disallow Ed25519ph/Ed448ph for CA certificates X-BeenThere: curdle@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "List for discussion of potential new security area wg." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 22 Jul 2016 23:56:31 -0000 DQo+IExlIDIyIGp1aWwuIDIwMTYgw6AgMTg6MDIsIElsYXJpIExpdXN2YWFyYSA8aWxhcmlsaXVz dmFhcmFAd2VsaG8uY29tPiBhIMOpY3JpdCA6DQo+IA0KPiBPbiBNb24sIEp1biAxMywgMjAxNiBh dCAxMDoxMjo1NUFNICswMDAwLCBEYW5nLCBRdXluaCAoRmVkKSB3cm90ZToNCj4+IEhpIGFsbCwN Cj4+IA0KPj4gUHJlaGFzaCBvciBub24tcHJlaGFzaCwgY2hvb3NpbmcgdGhlIG9uZSB3aGljaCB3 b3JrcyB3ZWxsIGZvciBhbGwgdXNlcw0KPj4gKG5vdCBqdXN0IHNpZ25pbmcgY2VydHMpIGlzIHRo ZSByaWdodCB0aGluZyB0byBkby4gSSBkb27CuXQga25vdyBob3cgbXVjaA0KPj4gdGhlIG5vbi1w cmVoYXNoIHZlcnNpb24gaXMgYWN0dWFsbHkgdXNlZCByaWdodCBub3cgKGRpZmZlcmVudCBmcm9t IGhvdw0KPj4gbXVjaCBpdCBpcyBzdXBwb3J0ZWQgaW4gbGlicmFyaWVzKS4NCg0KPiBb4oCmXQ0K DQo+IFRoaXMgbGVhdmVzIENSTHMsIHdoaWNoIGNvdWxkIHBvdGVudGlhbGx5IGJlIGxhcmdpc2gu IEJ1dCBhcmUNCj4gdGhvc2UgYWN0dWFsbHkgdXNlZCB0aGF0IG11Y2g/IEkgZGlkIHNlYXJjaCBm b3IgQ1JMIGZvciBvbmUNCj4gcHJhY3RpY3VsYXIgdmVyeSBoaWdoLWFjdGl2aXR5IFdlYlBLSSBj ZXJ0LCBhbmQgY291bGRuJ3QNCj4gZmluZCBpdCAoaXQgbWlnaHQgbm90IGV2ZW4gZXhpc3QpLiAN Cg0KSSBoYXZlIGVuY291bnRlcmVkIGxhcmdlIENSTHMgaW4gdGhlIHBhc3QgKGxhcmdlPXRlbnMg b2YgTUIpLCBhbmQgd2XigJlsbCBlbmNvdW50ZXIgbW9yZSBpbiB0aGUgZnV0dXJlLg0KV2l0aCBl SURBUywgYSBDQSBpc3N1aW5nIHF1YWxpZmllZCBjZXJ0aWZpY2F0ZXMgTVVTVCBwcm9kdWNlIENS THMgY29udGFpbmluZyBleHBpcmVkIGNlcnRpZmljYXRlcywgc28gdGhleSB3aWxsIG9ubHkgYmUg Z3Jvd2luZywgYW5kIHRoZXnigJlsbCBiZSB1c2VkIGxvbmcgYWZ0ZXIgdGhlIGNlcnRpZmljYXRl IGhhcyBleHBpcmVkIChhbmQgYWxzbyBhZnRlciB0aGUgQ0EgaXRzZWxmIGhhcyBleHBpcmVkKS4g T0NTUCBpcyBub3QgbWFuZGF0b3J5IGZvciBzdWNoIGNlcnRpZmljYXRlcy4NCg0KDQo= From nobody Fri Jul 22 16:58:02 2016 Return-Path: X-Original-To: curdle@ietfa.amsl.com Delivered-To: curdle@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 15BCC12D1C1 for ; Fri, 22 Jul 2016 16:57:59 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.922 X-Spam-Level: X-Spam-Status: No, score=-1.922 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=docusign2com.onmicrosoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id UbAtqU42kqx5 for ; Fri, 22 Jul 2016 16:57:57 -0700 (PDT) Received: from NAM02-CY1-obe.outbound.protection.outlook.com (mail-cys01nam02on0115.outbound.protection.outlook.com [104.47.37.115]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 1AD0D12B029 for ; Fri, 22 Jul 2016 16:57:57 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=DOCUSIGN2COM.onmicrosoft.com; s=selector1-docusign-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=Gw3M+HTgx3ZcsL7YVNot2FCBwEy2gCEtF5Y/ROB0qOw=; b=Xam6ibD/6xMfEPirgCpyyM8F8zLAqPa2juEhGEEl4IHWdcOPpRXevH2xupH+2TyaD2W8VBCe3sbZgzJu5LZv00wldCXvjVEedmBCfdSAU8FkzrA6ZMz26tx+CBINKNT7GMRgjtZDmdC5aJY8aKo2h0l5WJZY694xEz2D5MsII9E= Received: from BN3PR0401MB1395.namprd04.prod.outlook.com (10.161.209.154) by BN3PR0401MB1395.namprd04.prod.outlook.com (10.161.209.154) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id 15.1.544.10; Fri, 22 Jul 2016 23:57:53 +0000 Received: from BN3PR0401MB1395.namprd04.prod.outlook.com ([10.161.209.154]) by BN3PR0401MB1395.namprd04.prod.outlook.com ([10.161.209.154]) with mapi id 15.01.0544.017; Fri, 22 Jul 2016 23:57:53 +0000 From: Erwann Abalea To: Rob Stradling Thread-Topic: [Curdle] draft-ietf-curdle-pkix-00: a simplification proposal Thread-Index: AQHR5ELk+yRC9yp5Q0G41cpW5aPpog== Date: Fri, 22 Jul 2016 23:57:53 +0000 Message-ID: <209A988C-6195-4A8A-8A7D-9A10C8E56541@docusign.com> References: <015201d1caa9$ce55ac60$6b010520$@augustcellars.com> <2DD56D786E600F45AC6BDE7DA4E8A8C117F26424@eusaamb107.ericsson.se> <20160722113642.GA24793@LK-Perkele-V2.elisa-laajakaista.fi> <6F0EA612-DB5F-43A4-899C-36C2956B5D3F@docusign.com> <20160722181825.GA26572@LK-Perkele-V2.elisa-laajakaista.fi> <7C22F8A6-88C0-469F-8D4F-BCBF11922B11@docusign.com> <20160722200830.GA26782@LK-Perkele-V2.elisa-laajakaista.fi> <2647b6bd-e756-92e8-bf54-cdf9b0588fbc@comodo.com> <20160722210202.GA30680@LK-Perkele-V2.elisa-laajakaista.fi> In-Reply-To: Accept-Language: fr-FR, en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=Erwann.Abalea@docusign.com; x-ms-exchange-messagesentrepresentingtype: 1 x-originating-ip: [82.66.232.79] x-ms-office365-filtering-correlation-id: d9b85a3f-2f0d-45ca-95d6-08d3b28bfec7 x-microsoft-exchange-diagnostics: 1; BN3PR0401MB1395; 6:XjiZzup1jt6Z6dMb/WorEbC8lX73GhbCm1p4uzozr99I88RdpevweOw6iZ1HGlsMJZMRztwIjOTCoXIzjIFHW52DmLqgAKhKoVMGlFDMno0S5QFbPAz26xhZJe8j1h8G+weVQY1A2t+M8obndh3UFHi1oCUEvNX+GA+SzKJaG8Ze6Hjm+WtmNuIuN0wjqv2M7wEls4OmxZ1w/lMVTUdeL0qPh6lYzAUUIfBesMZ7akL85L+vOswgGJVYerZ+uH2gGP+qU0GA9fUgjrzXs52/wwcuiqPnST6ccepnDma391E=; 5:nDacbYn5OdX7/HsXG1xB4ABajVrkPqOEnEnB89vYbSJ3W3xDY251wNK2IXJ59RbTu2ApfZTUjMqTpJ2e5Nh+M3cf5FhCW/0gSSCmlI+fEjjaQdaoXVU6gPA9NHNJn3lozOifuNwOvU1WU5bAD4BaEg==; 24:FRVyTJFo472EzTvJDvGCMb4qRm4BjupCz7WIH256g7n8sAuJS10C/GyhfMQ7Bwz4GyOW2XqfR08PJVhcCAPHnrlUy9dTyxGkh7q+245BrQo=; 7:2tA1FGzoDlPkBoFdd3BJ0/vIWqCRsYlEtOEn2MsmAwsDzsGpL5OoDFQ6vuZ4hkf4GpZWPAlUYxGjqQge2QLbYdJbHwFgZtcAnL/whTu0K9xTCDyc+uzroh0W80cz0VsJyvT5Z9ZFlciVKKrTCNigiT4/vTI+JmBVL6ZCNRdUmzv/T5NC/qJkBnox6P0otkf3rlpJeWESCdHj2nfKeWHwzAU2K9NWRWC7NpbICAmboTqSMRtq+WggGt8+MfDSmYP6 x-microsoft-antispam: UriScan:;BCL:0;PCL:0;RULEID:;SRVR:BN3PR0401MB1395; x-microsoft-antispam-prvs: x-exchange-antispam-report-test: UriScan:(209352067349851); x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(601004)(2401047)(8121501046)(5005006)(10201501046)(3002001); SRVR:BN3PR0401MB1395; BCL:0; PCL:0; RULEID:; SRVR:BN3PR0401MB1395; x-forefront-prvs: 0011612A55 x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(6009001)(7916002)(189002)(199003)(51914003)(24454002)(110136002)(101416001)(97736004)(8676002)(83716003)(122556002)(105586002)(93886004)(86362001)(87936001)(99286002)(230783001)(189998001)(76176999)(54356999)(50986999)(68736007)(4326007)(5002640100001)(77096005)(2906002)(81156014)(81166006)(561944003)(19580395003)(11100500001)(3660700001)(19580405001)(3280700002)(33656002)(8936002)(92566002)(106116001)(7736002)(7846002)(10400500002)(66066001)(106356001)(36756003)(2900100001)(305945005)(82746002)(2950100001)(586003)(6116002)(102836003)(3846002)(104396002); DIR:OUT; SFP:1102; SCL:1; SRVR:BN3PR0401MB1395; H:BN3PR0401MB1395.namprd04.prod.outlook.com; FPR:; SPF:None; PTR:InfoNoRecords; MX:1; A:1; LANG:en; received-spf: None (protection.outlook.com: docusign.com does not designate permitted sender hosts) spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: text/plain; charset="Windows-1252" Content-ID: <986C9229C02EC24AB7E7510886BF5740@namprd04.prod.outlook.com> Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-OriginatorOrg: docusign.com X-MS-Exchange-CrossTenant-originalarrivaltime: 22 Jul 2016 23:57:53.2842 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 237e701c-327f-4cad-a5a1-dda2412d89d9 X-MS-Exchange-Transport-CrossTenantHeadersStamped: BN3PR0401MB1395 Archived-At: Cc: "curdle@ietf.org" , Ilari Liusvaara , Daniel Migault Subject: Re: [Curdle] draft-ietf-curdle-pkix-00: a simplification proposal X-BeenThere: curdle@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "List for discussion of potential new security area wg." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 22 Jul 2016 23:57:59 -0000 Thanks for the reference to the authoritative OID allocation by Verisign, R= ob. That=92s 1 octet less than expected. In the ASN.1 module I proposed, id-EdDSASignatureAlgorithm and id-EdDSAPubl= icKey are to be removed, and the other defined OIDs to be replaced by: id-pk-X25519 OBJECT IDENTIFIER ::=3D { iso(1) identified-organization(3) th= awte(101) 100 } id-pk-Ed25519 OBJECT IDENTIFIER ::=3D { 1 3 101 101 } id-pk-Ed25519ph OBJECT IDENTIFIER ::=3D { 1 3 101 102 } id-pk-X448 OBJECT IDENTIFIER ::=3D { 1 3 101 103 } id-pk-Ed448 OBJECT IDENTIFIER ::=3D { 1 3 101 104 } id-pk-Ed448ph OBJECT IDENTIFIER ::=3D { 1 3 101 105 } The following may not be necessary. id-sa-Ed25519 OBJECT IDENTIFIER ::=3D { id-pk-Ed25519 } id-sa-Ed25519ph OBJECT IDENTIFIER ::=3D { id-pk-Ed25519ph } id-sa-Ed448 OBJECT IDENTIFIER ::=3D { id-pk-Ed448 } id-sa-Ed448ph OBJECT IDENTIFIER ::=3D { id-pk-Ed448ph } Ditto for them. id-kaa-X25519 OBJECT IDENTIFIER ::=3D { id-pk-X25519 } id-kaa-X448 OBJECT IDENTIFIER ::=3D { id-pk-X448 } Cordialement, Erwann Abalea > Le 22 juil. 2016 =E0 23:31, Rob Stradling a = =E9crit : >=20 > On 22/07/16 22:02, Ilari Liusvaara wrote: >> On Fri, Jul 22, 2016 at 09:54:16PM +0100, Rob Stradling wrote: >>>=20 >>> It's not clear from my records if Rick reserved/delegated >>> 1.3.101.100...1.3.101.115 or 1.3.101.100..1.3.101.127 for EdDSA. It wo= n't >>> be hard to clarify that with Symantec though. >>=20 >> Well, we go by LAMPS recommedations, we need 6 OIDs. >=20 > From the raw minutes: > "David Benjamin's proposal: 3 OIDs per curve: ECDH (25519 & 448); > EdDSA (no PH); EdDSAph > ... > *** A hum to recommend David Benjamin's proposal was unanimously yes." >=20 > IIUC, this is what's required... >=20 > 1.3.101.100 ECDH 25519 > 1.3.101.101 EdDSA (no PH) 25519 > 1.3.101.102 EdDSAph 25519 > 1.3.101.103 ECDH 448 > 1.3.101.104 EdDSA (no PH) 448 > 1.3.101.105 EdDSAph 448 >=20 > Is that right? >=20 > >=20 > --=20 > Rob Stradling > Senior Research & Development Scientist > COMODO - Creating Trust Online >=20 From nobody Fri Jul 22 17:01:51 2016 Return-Path: X-Original-To: curdle@ietfa.amsl.com Delivered-To: curdle@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6A49E12D1E4 for ; Fri, 22 Jul 2016 17:01:50 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.2 X-Spam-Level: X-Spam-Status: No, score=-4.2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Y0JlHqal9NMf for ; Fri, 22 Jul 2016 17:01:47 -0700 (PDT) Received: from mmextmx2.mcr.colo.comodoca.net (mmextmx2.mcr.colo.comodoca.net [IPv6:2a02:1788:402:c00::c0a8:9cd6]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id BFDCD12B029 for ; Fri, 22 Jul 2016 17:01:46 -0700 (PDT) Received: (qmail 13015 invoked by uid 1004); 23 Jul 2016 00:01:44 -0000 Received: from ian.brad.office.comodo.net (HELO ian.brad.office.comodo.net) (192.168.0.202) by mmextmx2.mcr.colo.comodoca.net (qpsmtpd/0.84) with ESMTP; Sat, 23 Jul 2016 01:01:44 +0100 Received: (qmail 17386 invoked by uid 1000); 23 Jul 2016 00:01:44 -0000 Received: from and0004.comodo.net (HELO [192.168.0.58]) (192.168.0.58) (smtp-auth username rob, mechanism plain) by ian.brad.office.comodo.net (qpsmtpd/0.40) with (AES128-SHA encrypted) ESMTPSA; Sat, 23 Jul 2016 01:01:44 +0100 To: Erwann Abalea References: <015201d1caa9$ce55ac60$6b010520$@augustcellars.com> <2DD56D786E600F45AC6BDE7DA4E8A8C117F26424@eusaamb107.ericsson.se> <20160722113642.GA24793@LK-Perkele-V2.elisa-laajakaista.fi> <6F0EA612-DB5F-43A4-899C-36C2956B5D3F@docusign.com> <20160722181825.GA26572@LK-Perkele-V2.elisa-laajakaista.fi> <7C22F8A6-88C0-469F-8D4F-BCBF11922B11@docusign.com> <20160722200830.GA26782@LK-Perkele-V2.elisa-laajakaista.fi> <2647b6bd-e756-92e8-bf54-cdf9b0588fbc@comodo.com> <20160722210202.GA30680@LK-Perkele-V2.elisa-laajakaista.fi> <209A988C-6195-4A8A-8A7D-9A10C8E56541@docusign.com> From: Rob Stradling Message-ID: Date: Sat, 23 Jul 2016 01:01:44 +0100 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Thunderbird/45.2.0 MIME-Version: 1.0 In-Reply-To: <209A988C-6195-4A8A-8A7D-9A10C8E56541@docusign.com> Content-Type: text/plain; charset=windows-1252; format=flowed Content-Transfer-Encoding: 8bit Archived-At: Cc: "curdle@ietf.org" , Ilari Liusvaara , Daniel Migault Subject: Re: [Curdle] draft-ietf-curdle-pkix-00: a simplification proposal X-BeenThere: curdle@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "List for discussion of potential new security area wg." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 23 Jul 2016 00:01:50 -0000 On 23/07/16 00:57, Erwann Abalea wrote: > Thanks for the reference to the authoritative OID allocation by Verisign, Rob. > > That’s 1 octet less than expected. > > In the ASN.1 module I proposed, id-EdDSASignatureAlgorithm and id-EdDSAPublicKey are to be removed, and the other defined OIDs to be replaced by: > > id-pk-X25519 OBJECT IDENTIFIER ::= { iso(1) identified-organization(3) thawte(101) 100 } > id-pk-Ed25519 OBJECT IDENTIFIER ::= { 1 3 101 101 } > id-pk-Ed25519ph OBJECT IDENTIFIER ::= { 1 3 101 102 } > id-pk-X448 OBJECT IDENTIFIER ::= { 1 3 101 103 } > id-pk-Ed448 OBJECT IDENTIFIER ::= { 1 3 101 104 } > id-pk-Ed448ph OBJECT IDENTIFIER ::= { 1 3 101 105 } Thanks Erwann. IINM, that exactly matches what I suggested. -- Rob Stradling Senior Research & Development Scientist COMODO - Creating Trust Online From nobody Fri Jul 22 21:15:41 2016 Return-Path: X-Original-To: curdle@ietfa.amsl.com Delivered-To: curdle@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D523412D96A for ; Fri, 22 Jul 2016 21:15:39 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.7 X-Spam-Level: X-Spam-Status: No, score=-2.7 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id UH1rupo4kqoM for ; Fri, 22 Jul 2016 21:15:38 -0700 (PDT) Received: from mail-wm0-x22c.google.com (mail-wm0-x22c.google.com [IPv6:2a00:1450:400c:c09::22c]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 0062C12D781 for ; Fri, 22 Jul 2016 21:15:37 -0700 (PDT) Received: by mail-wm0-x22c.google.com with SMTP id o80so89237440wme.1 for ; Fri, 22 Jul 2016 21:15:37 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=xMjwikVhSq7oq9E+CmI6pxgEt5xpicvDOjuqziIfHgo=; b=SHoZwzw3JDUtUgkSnHx42DcBYdjiQ6UiTP0axd8QcAcPYkm8fSV32bBasum1Ate7/Z DYDU7zmsjOAE1n7GE48BpqCiQ2j94ZciBkxDcjWssZ1YdiKErSB6npaxWH05E9rGbp0B r78/kRxcGZOVI2qkV2TrTUiCcuVHF/cw/dTkmkMkT1bB5m4zL4GToysVbsqF9qoMDz+6 MK0DIEpgH03phFnoIfX50oQE5m26pYGBQECKyx35E/NGkrl4bXBD2eCgN1vYgb34NwIu Rl4XBMMaDv+n1i77oJdBXWIYMueyYEpVp8Q3y3HTVuaruZBrejj9vvN+JhTGaybe/WQc c95g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=xMjwikVhSq7oq9E+CmI6pxgEt5xpicvDOjuqziIfHgo=; b=k++XhWWDMiE/18z+34igdqeanAP3LgisdFgeUDPnLAl/b0fpu/13Vf8UuGx5eNaHa+ sLse+bHuQryGqyeslUJwuz0KjeURV6frg4aYLa4ZaRmRGbIxBA42yGM/2iaBRFQcnjal KF4cwSdDDM0/1yRwDGCP2CHYsZ8N8mByISU+4QqjbTGogDekBj9x5z6II3tyzosnO61s bN2kULcoqKd7GEBK8hrc5qCIKQS+PpKKzwyjgUJnerZiond7R2TZmZ/AQBqDa7U2bp4U 86vuXCtQ812PB7/RZRXqQGG2OUPwkMsCkgyCZEafzRASnFNetkOgROWwAphUvhafqrvt knPA== X-Gm-Message-State: ALyK8tLPvSw2G8cGtE/BH4TmFi8ks2I+8tTeXsDHFkjTed3mN+WRRFV5WX03qN/OSteNzg== X-Received: by 10.28.170.198 with SMTP id t189mr28057275wme.19.1469247336382; Fri, 22 Jul 2016 21:15:36 -0700 (PDT) Received: from [192.168.1.14] ([46.120.57.147]) by smtp.gmail.com with ESMTPSA id f10sm3880825wje.14.2016.07.22.21.15.35 (version=TLS1 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Fri, 22 Jul 2016 21:15:35 -0700 (PDT) Content-Type: text/plain; charset=utf-8 Mime-Version: 1.0 (Mac OS X Mail 9.3 \(3124\)) From: Yoav Nir In-Reply-To: <1B4F487E-7350-4B91-A63C-3F39857C8884@docusign.com> Date: Sat, 23 Jul 2016 07:15:33 +0300 Content-Transfer-Encoding: quoted-printable Message-Id: <5BCF86A7-654D-4159-B6D8-17B63D16F9C5@gmail.com> References: <19075EB00EA7FE49AFF87E5818D673D4138D60C7@PRODEXMB01W.eagle.usaa.com> <20160722160216.GA26177@LK-Perkele-V2.elisa-laajakaista.fi> <1B4F487E-7350-4B91-A63C-3F39857C8884@docusign.com> To: Erwann Abalea X-Mailer: Apple Mail (2.3124) Archived-At: Cc: "curdle@ietf.org" , Ilari Liusvaara Subject: Re: [Curdle] Proposal: Disallow Ed25519ph/Ed448ph for CA certificates X-BeenThere: curdle@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "List for discussion of potential new security area wg." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 23 Jul 2016 04:15:40 -0000 > On 23 Jul 2016, at 2:56 AM, Erwann Abalea = wrote: >=20 >=20 >> Le 22 juil. 2016 =C3=A0 18:02, Ilari Liusvaara = a =C3=A9crit : >>=20 >> On Mon, Jun 13, 2016 at 10:12:55AM +0000, Dang, Quynh (Fed) wrote: >>> Hi all, >>>=20 >>> Prehash or non-prehash, choosing the one which works well for all = uses >>> (not just signing certs) is the right thing to do. I don=C2=B9t know = how much >>> the non-prehash version is actually used right now (different from = how >>> much it is supported in libraries). >=20 >> [=E2=80=A6] >=20 >> This leaves CRLs, which could potentially be largish. But are >> those actually used that much? I did search for CRL for one >> practicular very high-activity WebPKI cert, and couldn't >> find it (it might not even exist).=20 >=20 > I have encountered large CRLs in the past (large=3Dtens of MB), and = we=E2=80=99ll encounter more in the future. > With eIDAS, a CA issuing qualified certificates MUST produce CRLs = containing expired certificates, so they will only be growing, and = they=E2=80=99ll be used long after the certificate has expired (and also = after the CA itself has expired). OCSP is not mandatory for such = certificates. CRLs are large, but they=E2=80=99re available all at once. You can=E2=80=99= t sign them several entries at a time, because the tbsCertList is a = SEQUENCE as is the revokedCertificates list. You have to have all the = data up front with the length field. Pre-hashing doesn=E2=80=99t save = you from storing the entire CRL in memory. Yoav From nobody Fri Jul 22 22:21:53 2016 Return-Path: X-Original-To: curdle@ietfa.amsl.com Delivered-To: curdle@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 72D5212DE02 for ; Fri, 22 Jul 2016 22:21:52 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.699 X-Spam-Level: X-Spam-Status: No, score=-2.699 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id nWtN-y8x1_RN for ; Fri, 22 Jul 2016 22:21:50 -0700 (PDT) Received: from mail-vk0-x236.google.com (mail-vk0-x236.google.com [IPv6:2607:f8b0:400c:c05::236]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 14D3A12D7DC for ; Fri, 22 Jul 2016 22:21:50 -0700 (PDT) Received: by mail-vk0-x236.google.com with SMTP id w127so183252113vkh.2 for ; Fri, 22 Jul 2016 22:21:50 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc; bh=dZl1+PIilb3Fn61swVagzoYYblVY6eltvzTQ/2Xg+bA=; b=gF4NAMPSpR7gp2t9S+G+ShkwCpv9dJFPLQLtnztAME5AiadKrXcS3doblk9ILV9y72 Fu9mDVrxto2bmoqm2E2cWwwArGJ7ShHVUtZMoAg+XGrihB7LWwoQjLZKL76l3PdVY7oB IbRl7aHbMM1yxwZQ+kbD77nTkLU1AwwKILFlZijkQ8uG9QLHZn08B2gLz9x9B5uLXkZR 2xMNzfcqlI+iO9v4gdg/itnpHqRnniYErQNmeMYbcDuAbVKn28kdB+XExNMFSV0c2KIo k2NmXJ/Cp7wiT/OsswNR6oh9QWcaMnnlAbct2kHfYOtWM60oJNPec6h4DSiJ2RHfM77J 6kQg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:in-reply-to:references:date :message-id:subject:from:to:cc; bh=dZl1+PIilb3Fn61swVagzoYYblVY6eltvzTQ/2Xg+bA=; b=HpGd1O5Q/CzAsu5jlnnPOPpIeHDA6cNhvGSILulHypbgQoT4cJxYxE9DJWd2wfEore 2rnImDGe5Mgs2pcKXbgYNaindsVSw8GVZLzBDrcRnvrYjVKtNy4P4PbKkHbxUgUTdO1o d/k6kvfqgXxXhVt+ZkNbJwWav0hqM9B4YpGoxABLQ+NtzkXBUK/RySxiVGzTMFUAnK6H xF/6LkeWSa805WNejxaeQ3py0Fuqt6Nu0JfDC2uEskLGk+WIEE47OS0zlKTg+X6yLk/O Z6Z01WkcKiLItIamt5XcvA+6GHnbZUbD8sofxMdwsutsLNIMuAyejqGzO0qt8bk4X/R8 BJxQ== X-Gm-Message-State: AEkoouvUBQpnvGv27+Uj7XrN5I2pKFuSIoE8bK15nCbCHyIbdQMVW0QDQSb0Gd5jVWq2KJmGBcQOOiuztfQ5Vg== MIME-Version: 1.0 X-Received: by 10.159.55.199 with SMTP id q65mr3826229uaq.125.1469251309049; Fri, 22 Jul 2016 22:21:49 -0700 (PDT) Received: by 10.159.39.194 with HTTP; Fri, 22 Jul 2016 22:21:48 -0700 (PDT) Received: by 10.159.39.194 with HTTP; Fri, 22 Jul 2016 22:21:48 -0700 (PDT) In-Reply-To: <5BCF86A7-654D-4159-B6D8-17B63D16F9C5@gmail.com> References: <19075EB00EA7FE49AFF87E5818D673D4138D60C7@PRODEXMB01W.eagle.usaa.com> <20160722160216.GA26177@LK-Perkele-V2.elisa-laajakaista.fi> <1B4F487E-7350-4B91-A63C-3F39857C8884@docusign.com> <5BCF86A7-654D-4159-B6D8-17B63D16F9C5@gmail.com> Date: Fri, 22 Jul 2016 22:21:48 -0700 Message-ID: From: Watson Ladd To: Yoav Nir Content-Type: multipart/alternative; boundary=94eb2c04c9a65c9dec053846ba23 Archived-At: Cc: Curdle , Ilari Liusvaara , Erwann Abalea Subject: Re: [Curdle] Proposal: Disallow Ed25519ph/Ed448ph for CA certificates X-BeenThere: curdle@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "List for discussion of potential new security area wg." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 23 Jul 2016 05:21:52 -0000 --94eb2c04c9a65c9dec053846ba23 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable On Jul 22, 2016 9:15 PM, "Yoav Nir" wrote: > > > > On 23 Jul 2016, at 2:56 AM, Erwann Abalea wrote: > > > > > >> Le 22 juil. 2016 =C3=A0 18:02, Ilari Liusvaara a =C3=A9crit : > >> > >> On Mon, Jun 13, 2016 at 10:12:55AM +0000, Dang, Quynh (Fed) wrote: > >>> Hi all, > >>> > >>> Prehash or non-prehash, choosing the one which works well for all use= s > >>> (not just signing certs) is the right thing to do. I don=C2=B9t know = how much > >>> the non-prehash version is actually used right now (different from ho= w > >>> much it is supported in libraries). > > > >> [=E2=80=A6] > > > >> This leaves CRLs, which could potentially be largish. But are > >> those actually used that much? I did search for CRL for one > >> practicular very high-activity WebPKI cert, and couldn't > >> find it (it might not even exist). > > > > I have encountered large CRLs in the past (large=3Dtens of MB), and we= =E2=80=99ll encounter more in the future. > > With eIDAS, a CA issuing qualified certificates MUST produce CRLs containing expired certificates, so they will only be growing, and they=E2= =80=99ll be used long after the certificate has expired (and also after the CA itself has expired). OCSP is not mandatory for such certificates. > > CRLs are large, but they=E2=80=99re available all at once. You can=E2=80= =99t sign them several entries at a time, because the tbsCertList is a SEQUENCE as is the revokedCertificates list. You have to have all the data up front with the length field. Pre-hashing doesn=E2=80=99t save you from storing the entire= CRL in memory. PKCS 11 has an init, advance, finish API for signing. HSM devices might have much less RAM then the hosts. Of course this API can make signatures without prehashing any verifier will verify, in one pass. > > Yoav > > _______________________________________________ > Curdle mailing list > Curdle@ietf.org > https://www.ietf.org/mailman/listinfo/curdle --94eb2c04c9a65c9dec053846ba23 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable


On Jul 22, 2016 9:15 PM, "Yoav Nir" <ynir.ietf@gmail.com> wrote:
>
>
> > On 23 Jul 2016, at 2:56 AM, Erwann Abalea <Erwann.Abalea@docusign.com> wrote:
> >
> >
> >> Le 22 juil. 2016 =C3=A0 18:02, Ilari Liusvaara <ilariliusvaara@welho.com> a =C3=A9= crit :
> >>
> >> On Mon, Jun 13, 2016 at 10:12:55AM +0000, Dang, Quynh (Fed) w= rote:
> >>> Hi all,
> >>>
> >>> Prehash or non-prehash, choosing the one which works well= for all uses
> >>> (not just signing certs) is the right thing to do. I don= =C2=B9t know how much
> >>> the non-prehash version is actually used right now (diffe= rent from how
> >>> much it is supported in libraries).
> >
> >> [=E2=80=A6]
> >
> >> This leaves CRLs, which could potentially be largish. But are=
> >> those actually used that much? I did search for CRL for one > >> practicular very high-activity WebPKI cert, and couldn't<= br> > >> find it (it might not even exist).
> >
> > I have encountered large CRLs in the past (large=3Dtens of MB), a= nd we=E2=80=99ll encounter more in the future.
> > With eIDAS, a CA issuing qualified certificates MUST produce CRLs= containing expired certificates, so they will only be growing, and they=E2= =80=99ll be used long after the certificate has expired (and also after the= CA itself has expired). OCSP is not mandatory for such certificates.
>
> CRLs are large, but they=E2=80=99re available all at once. You can=E2= =80=99t sign them several entries at a time, because the tbsCertList is a S= EQUENCE as is the revokedCertificates list. You have to have all the data u= p front with the length field.=C2=A0 Pre-hashing doesn=E2=80=99t save you f= rom storing the entire CRL in memory.

PKCS 11 has an init, advance, finish API for signing. HSM de= vices might have much less RAM then the hosts.

Of course this API can make signatures without prehashing an= y verifier will verify, in one pass.
>
> Yoav
>
> _______________________________________________
> Curdle mailing list
> Curdle@ietf.org
> https://www.i= etf.org/mailman/listinfo/curdle

--94eb2c04c9a65c9dec053846ba23-- From nobody Sat Jul 23 02:51:50 2016 Return-Path: X-Original-To: curdle@ietfa.amsl.com Delivered-To: curdle@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id BD1EA12B05D for ; Sat, 23 Jul 2016 02:51:48 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.699 X-Spam-Level: X-Spam-Status: No, score=-2.699 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id GZkJkJ1fLrQx for ; Sat, 23 Jul 2016 02:51:47 -0700 (PDT) Received: from mail-wm0-x233.google.com (mail-wm0-x233.google.com [IPv6:2a00:1450:400c:c09::233]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A0D4012D5D0 for ; Sat, 23 Jul 2016 02:51:45 -0700 (PDT) Received: by mail-wm0-x233.google.com with SMTP id i5so95112738wmg.0 for ; Sat, 23 Jul 2016 02:51:45 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:subject:from:in-reply-to:date:cc:message-id:references :to; bh=DB3uM4LaXXP+YX1LQ5H7o7QwbP2C1q+5l1bK6b71Rhc=; b=FfpcLdr8ul5gfNOSDANvvt9fbDHvbefsj81nE7v4dc9zl8CiWXqPVQe5E4TTKgVQUa vmoijgPF5A69F480mTie8fpVeLyQW7jL6c0Goiy4fbqDciUS5nvrNdbgt9N1j6LNQLol Uffjk7nTAUUaC/gtGYbv2wh/4jWZPWA9gK0UKEkGufITQOYYfaAd4g5cwa2HHaQ5puaS qZYdUAUBPNJtJ/gqxM2UtB7aGn+vEunTTQxsVREWGm7P6xJRUTFhBqCx4Nkp0C7sl6XY i+vx43hWE8gdhbV1xV1Xn1SRFhGk7EU6GHj8uv54fpiryfZZfzdOJ6/geU6LTjiOUlZk l6mg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:subject:from:in-reply-to:date:cc :message-id:references:to; bh=DB3uM4LaXXP+YX1LQ5H7o7QwbP2C1q+5l1bK6b71Rhc=; b=UBo0wFBa06ghFro3HucwxZcRVnfo3SVdVWC+6WxruErV4t7YUoZyz3FWnGIRybJcLd dvD/douJJadc3ne75DpEOeCXxFEMySZBWs+/6SIQVNf8fcEWTuParQhyrdredA+ttEgU s4Hcl8MYbRkLJZwTA9nubPXTPPe0n0r01I3BxyyRMOskWcfvtau/oMQyv/oJOaGnuoh+ rHi7wTo2/X5XtIusG1Pt5AxfEkQfYUaFdVeHF8vcfMc9UOSaE+rpD9dW1fbaK25zrTuX Qn7QRDuvie7aEV+UpE8MJ16heQNCk/LBRwLmaFLoWADfNj17zqsCvPxy8mUMi+gzrqPP KrsA== X-Gm-Message-State: ALyK8tJpMrxFlsIXtrVGYgYk+AQBoM7Iswxwxz/NQxwva6dF4WkZS4k59mkOSnor25mQbQ== X-Received: by 10.28.209.134 with SMTP id i128mr28395639wmg.97.1469267504064; Sat, 23 Jul 2016 02:51:44 -0700 (PDT) Received: from [192.168.1.14] ([46.120.57.147]) by smtp.gmail.com with ESMTPSA id v10sm5092357wjs.27.2016.07.23.02.51.42 (version=TLS1 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Sat, 23 Jul 2016 02:51:43 -0700 (PDT) Content-Type: multipart/alternative; boundary="Apple-Mail=_90478E36-EB43-4700-86F4-BB0E9F423BCA" Mime-Version: 1.0 (Mac OS X Mail 9.3 \(3124\)) From: Yoav Nir In-Reply-To: Date: Sat, 23 Jul 2016 12:51:41 +0300 Message-Id: References: <19075EB00EA7FE49AFF87E5818D673D4138D60C7@PRODEXMB01W.eagle.usaa.com> <20160722160216.GA26177@LK-Perkele-V2.elisa-laajakaista.fi> <1B4F487E-7350-4B91-A63C-3F39857C8884@docusign.com> <5BCF86A7-654D-4159-B6D8-17B63D16F9C5@gmail.com> To: Watson Ladd X-Mailer: Apple Mail (2.3124) Archived-At: Cc: Curdle , Ilari Liusvaara , Erwann Abalea Subject: Re: [Curdle] Proposal: Disallow Ed25519ph/Ed448ph for CA certificates X-BeenThere: curdle@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "List for discussion of potential new security area wg." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 23 Jul 2016 09:51:49 -0000 --Apple-Mail=_90478E36-EB43-4700-86F4-BB0E9F423BCA Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 > On 23 Jul 2016, at 8:21 AM, Watson Ladd wrote: >=20 >=20 > On Jul 22, 2016 9:15 PM, "Yoav Nir" > wrote: > > > > > > > On 23 Jul 2016, at 2:56 AM, Erwann Abalea = > wrote: > > > > > > > > >> Le 22 juil. 2016 =C3=A0 18:02, Ilari Liusvaara = > a =C3=A9crit = : > > >> > > >> On Mon, Jun 13, 2016 at 10:12:55AM +0000, Dang, Quynh (Fed) = wrote: > > >>> Hi all, > > >>> > > >>> Prehash or non-prehash, choosing the one which works well for = all uses > > >>> (not just signing certs) is the right thing to do. I don=C2=B9t = know how much > > >>> the non-prehash version is actually used right now (different = from how > > >>> much it is supported in libraries). > > > > > >> [=E2=80=A6] > > > > > >> This leaves CRLs, which could potentially be largish. But are > > >> those actually used that much? I did search for CRL for one > > >> practicular very high-activity WebPKI cert, and couldn't > > >> find it (it might not even exist). > > > > > > I have encountered large CRLs in the past (large=3Dtens of MB), = and we=E2=80=99ll encounter more in the future. > > > With eIDAS, a CA issuing qualified certificates MUST produce CRLs = containing expired certificates, so they will only be growing, and = they=E2=80=99ll be used long after the certificate has expired (and also = after the CA itself has expired). OCSP is not mandatory for such = certificates. > > > > CRLs are large, but they=E2=80=99re available all at once. You = can=E2=80=99t sign them several entries at a time, because the = tbsCertList is a SEQUENCE as is the revokedCertificates list. You have = to have all the data up front with the length field. Pre-hashing = doesn=E2=80=99t save you from storing the entire CRL in memory. >=20 > PKCS 11 has an init, advance, finish API for signing. HSM devices = might have much less RAM then the hosts. >=20 >=20 Ah, OK, thanks. I get the issue now. BTW: the infamous DoD CRL went to = hundreds, not tens of MB. Yoav --Apple-Mail=_90478E36-EB43-4700-86F4-BB0E9F423BCA Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8
On 23 Jul 2016, at 8:21 AM, Watson Ladd <watsonbladd@gmail.com> wrote:


On Jul 22, 2016 9:15 PM, "Yoav Nir" <ynir.ietf@gmail.com>= wrote:
>
>
> > On 23 Jul 2016, at 2:56 AM, Erwann Abalea <Erwann.Abalea@docusign.com> wrote:
> >
> >
> >> Le 22 juil. 2016 =C3=A0 18:02, Ilari Liusvaara <ilariliusvaara@welho.com> a =C3=A9crit :
> >>
> >> On Mon, Jun 13, 2016 at 10:12:55AM +0000, Dang, Quynh = (Fed) wrote:
> >>> Hi all,
> >>>
> >>> Prehash or non-prehash, choosing the one which works = well for all uses
> >>> (not just signing certs) is the right thing to do. I = don=C2=B9t know how much
> >>> the non-prehash version is actually used right now = (different from how
> >>> much it is supported in libraries).
> >
> >> [=E2=80=A6]
> >
> >> This leaves CRLs, which could potentially be largish. But = are
> >> those actually used that much? I did search for CRL for = one
> >> practicular very high-activity WebPKI cert, and = couldn't
> >> find it (it might not even exist).
> >
> > I have encountered large CRLs in the past (large=3Dtens of = MB), and we=E2=80=99ll encounter more in the future.
> > With eIDAS, a CA issuing qualified certificates MUST produce = CRLs containing expired certificates, so they will only be growing, and = they=E2=80=99ll be used long after the certificate has expired (and also = after the CA itself has expired). OCSP is not mandatory for such = certificates.
>
> CRLs are large, but they=E2=80=99re available all at once. You = can=E2=80=99t sign them several entries at a time, because the = tbsCertList is a SEQUENCE as is the revokedCertificates list. You have = to have all the data up front with the length field.  Pre-hashing = doesn=E2=80=99t save you from storing the entire CRL in memory.

PKCS 11 has an init, advance, finish API for = signing. HSM devices might have much less RAM then the hosts.



Ah, OK, thanks. I get the issue now. BTW: the infamous = DoD CRL went to hundreds, not tens of MB.

Yoav

= --Apple-Mail=_90478E36-EB43-4700-86F4-BB0E9F423BCA-- From nobody Sat Jul 23 10:57:33 2016 Return-Path: X-Original-To: curdle@ietfa.amsl.com Delivered-To: curdle@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id F3A2C12D6AA for ; Sat, 23 Jul 2016 10:57:31 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.418 X-Spam-Level: X-Spam-Status: No, score=-2.418 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_SORBS_WEB=0.77, RP_MATCHES_RCVD=-1.287, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Psp_-TXbNrHG for ; Sat, 23 Jul 2016 10:57:29 -0700 (PDT) Received: from mail2.augustcellars.com (augustcellars.com [50.45.239.150]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 5A53912D6A8 for ; Sat, 23 Jul 2016 10:57:29 -0700 (PDT) Received: from hebrews (69.38.252.84) by mail2.augustcellars.com (192.168.0.56) with Microsoft SMTP Server (TLS) id 15.0.1178.4; Sat, 23 Jul 2016 11:03:20 -0700 From: Jim Schaad To: 'Rob Stradling' , 'Ilari Liusvaara' References: <015201d1caa9$ce55ac60$6b010520$@augustcellars.com> <2DD56D786E600F45AC6BDE7DA4E8A8C117F26424@eusaamb107.ericsson.se> <20160722113642.GA24793@LK-Perkele-V2.elisa-laajakaista.fi> <6F0EA612-DB5F-43A4-899C-36C2956B5D3F@docusign.com> <20160722181825.GA26572@LK-Perkele-V2.elisa-laajakaista.fi> <7C22F8A6-88C0-469F-8D4F-BCBF11922B11@docusign.com> <20160722200830.GA26782@LK-Perkele-V2.elisa-laajakaista.fi> <2647b6bd-e756-92e8-bf54-cdf9b0588fbc@comodo.com> <20160722210202.GA30680@LK-Perkele-V2.elisa-laajakaista.fi> In-Reply-To: Date: Sat, 23 Jul 2016 13:57:03 -0400 Message-ID: <018301d1e50b$a06b69d0$e1423d70$@augustcellars.com> MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit X-Mailer: Microsoft Outlook 16.0 Thread-Index: AQIE5gnRg+NPLQDCDo5zqhaRbw9e4QJEq9NrAhDA+ucBvDmWDAJo4SkBAglB+FYCDKZKSAHDYJUpAbj97B0BXmy7+gLJx39LAdZ/H9ifD+7w4A== Content-Language: en-us X-Originating-IP: [69.38.252.84] Archived-At: Cc: curdle@ietf.org, 'Erwann Abalea' , 'Daniel Migault' Subject: Re: [Curdle] draft-ietf-curdle-pkix-00: a simplification proposal X-BeenThere: curdle@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "List for discussion of potential new security area wg." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 23 Jul 2016 17:57:32 -0000 > -----Original Message----- > From: Curdle [mailto:curdle-bounces@ietf.org] On Behalf Of Rob Stradling > Sent: Friday, July 22, 2016 5:31 PM > To: Ilari Liusvaara > Cc: curdle@ietf.org; Erwann Abalea ; Daniel > Migault > Subject: Re: [Curdle] draft-ietf-curdle-pkix-00: a simplification proposal > > On 22/07/16 22:02, Ilari Liusvaara wrote: > > On Fri, Jul 22, 2016 at 09:54:16PM +0100, Rob Stradling wrote: > >> > >> It's not clear from my records if Rick reserved/delegated > >> 1.3.101.100...1.3.101.115 or 1.3.101.100..1.3.101.127 for EdDSA. It > >> won't be hard to clarify that with Symantec though. > > > > Well, we go by LAMPS recommedations, we need 6 OIDs. > > From the raw minutes: > "David Benjamin's proposal: 3 OIDs per curve: ECDH (25519 & 448); > EdDSA (no PH); EdDSAph > ... > *** A hum to recommend David Benjamin's proposal was unanimously yes." > > IIUC, this is what's required... > > 1.3.101.100 ECDH 25519 > 1.3.101.101 EdDSA (no PH) 25519 > 1.3.101.102 EdDSAph 25519 > 1.3.101.103 ECDH 448 > 1.3.101.104 EdDSA (no PH) 448 > 1.3.101.105 EdDSAph 448 This is what I recommended in the presentation and expect to have implemented. I don't know that the numbers are right but the spirit is. Jim > > Is that right? > > > > -- > Rob Stradling > Senior Research & Development Scientist > COMODO - Creating Trust Online > > _______________________________________________ > Curdle mailing list > Curdle@ietf.org > https://www.ietf.org/mailman/listinfo/curdle