Subject: Required Algorithms for Certificates

From: "Jim Schaad" <[email-masked]>
Date: Tue, 12 Dec 2000 17:45:55 -0800

In reviewing the algorithm draft (draft-ietf-pkix-ipki-pkalgs-01.txt) again,
I remembered that I did have one problem with the draft.  I think that it is
fine that the certificate structure draft does not contain algorithm
information.  However I feel that the algorithms draft needs to have some
MUST style statements contained in it.  I propose adding the following text:

To fully comply with this document, implementations MUST support DSA
Signature (section 2.2.2).  Implementations MAY support MD2 RSA signatures
for validation but MUST NOT create new certificates using this algorithm.
Implementations MAY support all other algorithms in this document at their
discretion.

jim schaad

---

From: Russ Housley <[email-masked]>
Date: Wed, 20 Dec 2000 12:05:57 -0500

As everyone who was at the meeting in San Diego knows, this posting lead to 
a long discussions in PKIX, S/MIME, and SAAG sessions.  Based on those 
discussions, I suggest a possible way forward for son-of-rfc2459.

CAs MUST be able to sign certificates and CRLs with at least one of the 
following:
         - DSA with SHA-1, or
         - RSA with SHA-1.

CAs MAY sign certificates and CRLs with any additional algorithms that they 
wish.

Certificate users MUST be able to validate signatures on certificates and 
CRLs with all of the following:
         - DSA with SHA-1, and
         - RSA with SHA-1.

Certificate users MAY validate signatures on certificates and CRLs with any 
additional algorithms that they wish.

Russ

---

From: Paul Hoffman / VPNC <[email-masked]>
Date: Thu, 21 Dec 2000 13:26:30 -0800

At 12:05 PM -0500 12/20/00, Russ Housley wrote:
>Certificate users MUST be able to validate signatures on 
>certificates and CRLs with all of the following:
>         - DSA with SHA-1, and
>         - RSA with SHA-1.

At the VPN bakeoff in San Diego in January of this year, only a tiny 
fraction of the IPsec implementations could verify DSA certs. Heck, 
some of the CA vendors there weren't able to issue DSA certs for 
testing.

Given that VPNs are one of the major users of the PKIX protocol (and 
are arguably the largest base of deployed use of PKIX), having this 
WG say "almost all existing IPsec implementations are non-conformant" 
is somewhat harsh.

If we are interested in PKIX reflecting deployed reality, the 
document should be MUST RSA, MAY DSA for both CAs and cert users. 
Note the "MAY DSA" instead of "SHOULD DSA": the only reason a user 
would use DSA is if that is the only format supported by the CA, and 
few if any significant CAs did that. We should not say "SHOULD DSA" 
unless we believe that there is already widespread interoperability 
of DSA implementations; that seems unlikely, given how little public 
testing there has been for DSA certs.

--Paul Hoffman, Director
--VPN Consortium