Subject: [keyassure] Opening issue #21: "Need to specify which crypto algorithms and certificate types are mandatory to implement"

From: Warren Kumari <[email-masked]>
Date: Fri, 25 Feb 2011 16:31:40 -0500

Hi all,

While we are all ruminating on the other issues, I figured we might as  
well try address this one:

Need to specify which crypto algorithms and certificate types are  
mandatory to implement -- http://trac.tools.ietf.org/wg/dane/trac/ticket/21

Description:
Currently, the draft is silent on which crypto algorithms and  
certificate types must be implemented for interoperability. It should  
be specific before the document is finished.

W

---

From: Phillip Hallam-Baker <[email-masked]>
Date: Fri, 25 Feb 2011 16:52:06 -0500

Currently, the only digest algorithm that can be recommended is SHA-2

We really do need SHA2 in here as a MUST, unless we are still discussing
this when the SHA3 competition results are out.

I would strongly suggest NOT supporting SHA1 in any form.

On Fri, Feb 25, 2011 at 4:31 PM, Warren Kumari <[email-masked]> wrote:

> Hi all,
>
> While we are all ruminating on the other issues, I figured we might as well
> try address this one:
>
> Need to specify which crypto algorithms and certificate types are mandatory
> to implement -- http://trac.tools.ietf.org/wg/dane/trac/ticket/21
>
> Description:
> Currently, the draft is silent on which crypto algorithms and certificate
> types must be implemented for interoperability. It should be specific before
> the document is finished.
>
>
> W
> _______________________________________________
> keyassure mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/keyassure
>

-- 
Website: http://hallambaker.com/

---

From: Paul Hoffman <[email-masked]>
Date: Fri, 25 Feb 2011 14:02:38 -0800

On 2/25/11 1:31 PM, Warren Kumari wrote:
> certificate types must be implemented for interoperability. It should be
> specific before the document is finished.

Certificate type:

- Writing both type 1 and 2 must be supported by all DNS implementations

- Processing type 1 must be supported by all TLS clients.

- Processing type 2 should be supported by all TLS clients. The 
exceptions are TLS clients that do not use the PKIX certificate format 
for trust anchors.

Hash algorithm:

- All implementations must support SHA-256.

- All implementations should have the facility to later use other hash 
algorithms.

---

From: Jakob Schlyter <[email-masked]>
Date: Sun, 27 Feb 2011 13:27:35 +0100

> - All implementations must support SHA-256.

i.e., reference type 2.

> - All implementations should have the facility to later use other hash algorithms.

Also, all implementations must support reference type 0 (aka "full certificate").

	jakob

---

From: Paul Hoffman <[email-masked]>
Date: Sun, 27 Feb 2011 09:28:34 -0800

> Also, all implementations must support reference type 0 (aka "full certificate").

Er, right, of course. That too.