Subject: Re: [saag] draft-iab-crypto-alg-agility-01.txt

From: Peter Gutmann <[email-masked]>
Date: Mon, 13 Apr 2015 09:21:46 +0000

Russ Housley <[email-masked]> writes:

>CMS does not have any MTI algorithms.

Ah, sure, I was meaning S/MIME.  My issue was more with algorithms specified
for political reasons (and not just the obvious RSA-patent issue, I chose that
because it was a long time ago and I doubt anyone cares any more, but more
recently stuff like the NIST curves vs. 25519 et al, where the NIST curves
seem to have been chosen purely because they came from NIST), in which case
the MTIs aren't always the best to use.

(Admittedly that does make it a bit difficult to be precise over what to do
when the MTI isn't necessarily the best-TI).

>First, when there is more than one MTI algorithm, there needs to be adequate
>diversity, otherwise a cryptoanalytic advance that weakens one will also
>weaken the other.  I added some text on diversity:

Sounds good.

(In particular the current obsession with ECC for everything makes me, and a
few other crypto engineers I've talked to at various points, rather nervous).

>Are there any other aspects?

Nope, I think that's it.

Peter.

---

From: Ian G <[email-masked]>
Date: Mon, 13 Apr 2015 16:11:36 +0100

> few other crypto engineers I've talked to at various points, rather nervous).

Concur - if there is a reason for multiple public key algorithms it is 
that EC makes me nervous and I'd be almost happy to see RSA alongside EC.

However, EC doesn't make me nervous enough to insist on keeping RSA.  I 
think if cryptographers have been bashing at EC for a decade now, and 
haven't found a weakness, that's good enough.  The benefits of just one 
EC algorithm for all overwhelm any FUDish nervousness about that rarest 
of beasts, cryptographic advances.

iang