Subject: [jose] Open Issue for WG Discussion: Minimum key size for RSA signature

From: Mike Jones <[email-masked]>
Date: Thu, 5 Apr 2012 23:56:40 +0000

The JWA spec currently says that "A 2048-bit or longer key length MUST be used with this algorithm" about RSA key sizes.  During the meeting in Paris, Eric Rescorla pointed out that 1024 bit keys are commonly used and ask whether we wanted to allow them.

The background for the current 2048 bit requirement is that NIST deprecated the use of 1024 bit keys at the end of 2010 and disallowed their use after 2013 (see Section 3 of NIST Special Publication 800-131A, Table 2 on p. 5 and the discussion that follows on p. 6 - http://csrc.nist.gov/publications/nistpubs/800-131A/sp800-131A.pdf).

Given 2013 is right around the corner in standards time, does anyone want to make the case that we need to allow key lengths shorter than 2048 bits in the standard?

                                                                -- Mike

---

From: John Bradley <[email-masked]>
Date: Thu, 5 Apr 2012 21:05:39 -0300

1024bit keys are commonly used to verify existing documents.  They are also used in older systems and to communicate with older systems.

If you unwind the NIST and FIPS tangle any new systems being deployed MUST be capable of using 2048 or greater key sizes for signing.

We are in the lucky position of not having a legacy JOSE infrastructure to worry about.  Let's not decide to add algorithms that are already deprecated.

John B.
On 2012-04-05, at 8:56 PM, Mike Jones wrote:

> The JWA spec currently says that “A 2048-bit or longer key length MUST be used with this algorithm” about RSA key sizes.  During the meeting in Paris, Eric Rescorla pointed out that 1024 bit keys are commonly used and ask whether we wanted to allow them.
>  
> _______________________________________________
> jose mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/jose