Subject: [Secdispatch] Deterministic generation of public key pairs

From: Phillip Hallam-Baker <[email-masked]>
Date: Tue, 10 Mar 2020 11:37:11 -0400

[Yes I know this is too late for Vancouver, wanting to discuss]

As folk may have noticed, I am currently proposing CFRG start work on the
threshold cryptography work used in the Mesh. I would appreciate views on
what should be done with another piece of the Mesh, the UDF scheme.

The original goal of UDF was fairly modest, 'lets do PGP fingerprints a bit
better using Base32'. But it has since gown. Most of the pieces are pretty
unremarkable. How many formats do people need to represent a nonce in text?

But one part that I have discovered is increasingly useful is the use of
deterministic key generation. So for example let us say I use the udf tool
to create an SSH key:

udf keygen /x448
UDF: ZAAA-FFQA-3LE5-SAHG-E6K6-HOTN-TVLB-K4A

udf config ssh-agent ZAAA-FFQA-3LE5-SAHG-E6K6-HOTN-TVLB-K4A

This is a seed that can be written down and can be used to generate a
private keypair using any of the commonly used public key algorithms. So
you can use it for any application where you would use traditional key
escrow.

One thing I use this for is to move S/MIME and PGP keys about. Can also use
it to keep a paper back up of whole disk encryption keys etc.

The spec (but not the tool yet) also supports Shamir Secret Sharing. I need
to rejig that to match the developments in the threshold spec.

So is this something we should do and if so where? This is separable from
the Mesh and does have some functionality overlap. But it also makes a lot
of common sysadmin config much easier.

---

From: Michael Richardson <[email-masked]>
Date: Tue, 10 Mar 2020 13:27:58 -0400

> of common sysadmin config much easier.

I think AD sponsorship for the entire UDF document.
(Not just the deterministic key generation part. or was that part of your goal?)

A better name is needed, as there has been snakeoil created that had a
similar name.

--
Michael Richardson <[email-masked]>, Sandelman Software Works
 -= IPv6 IoT consulting =-

---

From: Phillip Hallam-Baker <[email-masked]>
Date: Tue, 10 Mar 2020 13:36:14 -0400

> (Not just the deterministic key generation part. or was that part of your

I would like to do the whole doc can drop Secure Internet Names which are a
bit on the edge. The digest function parts could be bikeshedded of course
but probably not usefully.

> A better name is needed, as there has been snakeoil created that had a

I am OK with the IETF calling it anything people like except for Fred.

If isn't really a fingerprint format at this point either.

---

From: Michael Richardson <[email-masked]>
Date: Wed, 11 Mar 2020 13:16:01 -0400

Phillip Hallam-Baker <[email-masked]> wrote:
    >> Phillip Hallam-Baker <[email-masked]> wrote: > udf config
    >> ssh-agent ZAAA-FFQA-3LE5-SAHG-E6K6-HOTN-TVLB-K4A
    >>
    >> > This is a seed that can be written down and can be used to generate
    >> a > private keypair using any of the commonly used public key
    >> algorithms. So > you can use it for any application where you would
    >> use traditional key > escrow.
    >>
    >> > One thing I use this for is to move S/MIME and PGP keys about. Can
    >> also use > it to keep a paper back up of whole disk encryption keys
    >> etc.
    >>
    >> > The spec (but not the tool yet) also supports Shamir Secret Sharing.
    >> I need > to rejig that to match the developments in the threshold
    >> spec.
    >>
    >>
    >> > So is this something we should do and if so where? This is separable
    >> from > the Mesh and does have some functionality overlap. But it also
    >> makes a lot > of common sysadmin config much easier.
    >>
    >> I think AD sponsorship for the entire UDF document.  (Not just the
    >> deterministic key generation part. or was that part of your goal?)
    >>

    > I would like to do the whole doc can drop Secure Internet Names which
    > are a bit on the edge. The digest function parts could be bikeshedded
    > of course but probably not usefully.

okay, we agree that the whole document should go as a single thing.

    > If isn't really a fingerprint format at this point either.

It was specifically the Deterministic Generation of Public Key Pairs that I
think matches some decade-old snake oil.  I will google a bit to see if I can
find that.
Some variation on "Portable Privacy" might be the right direction.

I think that this Beauty Contest is the only important thing left to do with
the document :-), which I guess says something how mature I think it is.

I've had an offline 1024-bit RSA key [email-masked] in a secure place
six different generations of media for 25 years.
Clearly, it's now too weak to bother with.

--
]               Never tell me the odds!                 | ipv6 mesh networks [
]   Michael Richardson, Sandelman Software Works        |    IoT architect   [
]     [email-masked]  http://www.sandelman.ca/        |   ruby on rails    [