Subject: [lamps] How to deal with Triple-DES in CMP Algorithms

From: "Brockhaus, Hendrik" <[email-masked]>
Date: Fri, 23 Oct 2020 16:12:13 +0000

In CMP (RFC 4210) Triple-DES CBC is used for encrypted key transport.
In CMS Algorithms (RFC 3370) Triple-DES key wrap and CBC is specified.
In RFC 8429 Triple-DES is deprecated for use in Kerberos.
I see Triple-DES still in use for S/MIME and elsewhere.

Currently I am writing the I-D on CMP Algorithms.
Should I specify Triple-DES as an alternative to AES or should I drop it?

Hendrik

Hendrik Brockhaus
Siemens AG
mailto:[email-masked]

www.siemens.com

Siemens Aktiengesellschaft: Chairman of the Supervisory Board: Jim Hagemann Snabe; Managing Board: Joe Kaeser, Chairman, President and Chief Executive Officer; Roland Busch, Klaus Helmrich, Cedrik Neike, Matthias Rebellius, Ralf P. Thomas, Judith Wiese; Registered offices: Berlin and Munich, Germany; Commercial registries: Berlin-Charlottenburg, HRB 12300, Munich, HRB 6684; WEEE-Reg.-No. DE 23691322

---

From: Russ Housley <[email-masked]>
Date: Fri, 23 Oct 2020 12:24:05 -0400

S/MIME has moved to AES.  First it became a SHOULD, and then a MUST.

Changes from S/MIME v3 to S/MIME v3.1 included:

   -  The AES symmetric encryption algorithm has been included as a
      SHOULD implement.

Changes from S/MIME v3.1 to S/MIME v3.2 includes:

   -  Section 2.5.2: Replaced reference "sha1WithRSAEncryption" with
      "sha256WithRSAEncryption", replaced "DES-3EDE-CBC" with "AES-128
      CBC", and deleted the RC5 example.

Changes for S/MIME v4.0 includes:

   -  Updated the content-encryption algorithms (Sections 2.7 and
      2.7.1.2): added AES-256 Galois/Counter Mode (GCM), added
      ChaCha20-Poly1305, removed mention of AES-192 Cipher Block
      Chaining (CBC), and marked tripleDES as historic.

Russ

> On Oct 23, 2020, at 12:12 PM, Brockhaus, Hendrik <[email-masked]> wrote:
>