Subject: Re: [Curdle] Some work for the group

From: Brian Smith <[email-masked]>
Date: Thu, 2 Feb 2017 19:13:43 -1000

Nikos Mavrogiannopoulos <[email-masked]> wrote:
> Brian Smith wrote:
>> Besides the security issue, my understanding is that using the
>> prehash
>> variant would result in lots of interop failures as, AFAICT, there
>> isn't going to be much support for it in verification libraries.
>
> Isn't that orthogonal to the question? If the prehash version is going
> to cause interop issues is not affected by the text quoted above. Your
> comment is on whether including the prehashed version at all.

No, it's not orthogonal. If we don't include the prehash version at
all, there won't be interop failures. Again, I don't see any
significant support for the prehash variant on the verification side.
It's a bad idea to let or encourage CAs sign things using an algorithm
that most verifiers are unlikely to implement.

Cheers,
Brian
-- 
https://briansmith.org/

---

From: Nikos Mavrogiannopoulos <[email-masked]>
Date: Mon, 20 Feb 2017 10:39:27 +0100

> significant support for the prehash variant on the verification side.

As I said your argument is about adding this variant, and not about the
actual question which is whether it should be treated specially with
regards to CA usage.

> It's a bad idea to let or encourage CAs sign things using an
> algorithm that most verifiers are unlikely to implement.

Could you please clarify what do you mean by most? (I personally
intended to implement only the prehashed variant not the other because
it is the only variant that be used with HSMs). However, if there is a
consensus that the prehashed variant shouldn't be used, we shouldn't
drag it in the proposal.

regards,
Nikos

---

From: Daniel Migault <[email-masked]>
Date: Mon, 20 Feb 2017 14:32:18 +0000

Thanks for the information Nikos.

I agree that we should find a concensus on whether the pre-hashed version should considered or not.  

One reason for not considering it is interoperability issue. Could we describe them a bit deeper ?

Yours, 

Daniel

-----Original Message-----
From: Nikos Mavrogiannopoulos [mailto:[email-masked]] 
Sent: Monday, February 20, 2017 4:39 AM
To: Brian Smith <[email-masked]>
Cc: Daniel Migault <[email-masked]>; Phillip Hallam-Baker <[email-masked]>; Dang, Quynh (Fed) <[email-masked]>; Jim Schaad <[email-masked]>; Curdle <[email-masked]>; Salz, Rich <[email-masked]>
Subject: Re: [Curdle] Some work for the group

On Thu, 2017-02-02 at 19:13 -1000, Brian Smith wrote:
> > > prehash variant would result in lots of interop failures as, 
> > > AFAICT, there isn't going to be much support for it in 
> > > verification libraries.
> > 
> > Isn't that orthogonal to the question? If the prehash version is 
> > going to cause interop issues is not affected by the text quoted 
> > above.
> > Your

As I said your argument is about adding this variant, and not about the actual question which is whether it should be treated specially with regards to CA usage.

> that most verifiers are unlikely to implement.

Could you please clarify what do you mean by most? (I personally intended to implement only the prehashed variant not the other because it is the only variant that be used with HSMs). However, if there is a consensus that the prehashed variant shouldn't be used, we shouldn't drag it in the proposal.

regards,
Nikos