Subject: Key Sizes in S/MIME v3.2

From: "Turner, Sean P." <[email-masked]>
Date: Tue, 19 Feb 2008 11:34:59 -0500

From the mail discussion we had in December, it's pretty clear to me that
key sizes from 1024-2048 ought to be the MUST and other key sizes are MAY.
I'm suggesting the following text:

Key sizes from 1024 bits to 2048 buts MUST be supported. Keys sizes larger
than 2048 MAY be supported.

Should we put a MUST NOT or SHOULD NOT in for key sizes smaller than 1024?

I also removed the ECDSA text so the key sizes only refer to RSA/DSA keys.

spt

---

From: Paul Hoffman <[email-masked]>
Date: Tue, 19 Feb 2008 10:42:17 -0800

>than 2048 MAY be supported.

Sure.

>Should we put a MUST NOT or SHOULD NOT in for key sizes smaller than 1024?

MUST NOT or SHOULD NOT *what*? Generate, or validate?

---

From: Russ Housley <[email-masked]>
Date: Tue, 19 Feb 2008 17:08:30 -0500

>than 2048 MAY be supported.

s/buts/bits/

>Should we put a MUST NOT or SHOULD NOT in for key sizes smaller than 1024?

I think we ought to be forgiving on receive.  Thus, I suggest:
Message originators SHOULD NOT use key sizes smaller than 1024 bits 
for private key operations.

Russ

---

From: "Turner, Sean P." <[email-masked]>
Date: Wed, 20 Feb 2008 07:17:07 -0500

I should have been clearer.

RFC 3850 current says (sec 4.3):

 Key sizes from 512 bits to 2048 bits MUST be supported. 

Suggesting it be replaced with:
 
 Key sizes from 1024 bits to 2048 bits MUST be supported. 

Here are the suggested changes RFC 3851 (sec 4.1):

 If an S/MIME agent needs to generate an RSA key pair,
 then the S/MIME agent or some related administrative
 utility or function SHOULD generate RSA key pairs
 using the following guidelines.  A user agent SHOULD
 generate RSA key pairs at a minimum key size of 1024
                                         was 768 ^^^^
 bits.  A user agent MUST NOT generate RSA key pairs
 less than 768 bits long. Creating keys longer than
           ^^^ was 512
 1024 bits can cause some older S/MIME receiving agents
 to not be able to verify signatures, but gives better
 security and is therefore valuable.  A receiving agent
 SHOULD be able to verify signatures with keys of any
 size over 768 bits. Some agents created in the United
           ^^^ was 512
 States have chosen to create 512 bit keys in order to
 get more advantageous export licenses.  However, 512
 bit keys are considered by many to be cryptographically
 insecure. Implementers SHOULD be aware that multiple
 (active) key pairs can be associated with a single
 individual.  For example, one key pair can be used
 to support confidentiality, while a different key pair
 can be used for authentication. 

Thoughts?

spt

>-----Original Message-----
>From: [email-masked] 
>[mailto:[email-masked]] On Behalf Of Paul Hoffman
>Sent: Tuesday, February 19, 2008 1:42 PM
>To: Turner, Sean P.; [email-masked]
>Subject: Re: Key Sizes in S/MIME v3.2
>
>
>>  >From the mail discussion we had in December, it's pretty 
>clear to me 
>>that key sizes from 1024-2048 ought to be the MUST and other 
>key sizes are MAY.
>>Key sizes from 1024 bits to 2048 buts MUST be supported. Keys sizes 
>>larger than 2048 MAY be supported.
>
>Sure.
>

---

From: "Turner, Sean P." <[email-masked]>
Date: Wed, 20 Feb 2008 07:50:20 -0500

>[mailto:[email-masked]] On Behalf Of Turner, Sean P.
>Sent: Wednesday, February 20, 2008 7:17 AM
>To: [email-masked]
>Subject: RE: Key Sizes in S/MIME v3.2
>
>
> If an S/MIME agent needs to generate an RSA key pair,  then 
>the S/MIME agent or some related administrative  utility or 
>function SHOULD generate RSA key pairs  using the following 
>guidelines.  A user agent SHOULD  generate RSA key pairs at a 
>minimum key size of 1024 bits.
>            was 768 ^^^^    
>A user agent MUST NOT generate RSA key pairs  less than 768 
>                                                was 512 ^^^ 
>bits long. Creating keys longer than
> 1024 bits can cause some older S/MIME receiving agents  to 
>not be able to verify signatures, but gives better  security 
>and is therefore valuable.  A receiving agent  SHOULD be able 
>to verify signatures with keys of any  size over 768 bits. 
>                                         was 512 ^^^
>Some agents created in the United
> States have chosen to create 512 bit keys in order to  get 
>more advantageous export licenses.  However, 512  bit keys are 
>considered by many to be cryptographically  insecure. 
>Implementers SHOULD be aware that multiple
>individual.  For example, one key pair can be used  to support 
>confidentiality, while a different key pair  can be used for 
>authentication. 
>
>Thoughts?
>
>spt
>

---

From: Simon Josefsson <[email-masked]>
Date: Wed, 20 Feb 2008 13:59:39 +0100

>  size over 768 bits. Some agents created in the United

I agree with your proposed change except for the last one -- is there
any motivation to drop the SHOULD regarding verification of signatures
done with 512 bit keys?  I don't think there is one.  Alerting the user
that the key is insecure, or other user interface considerations, is
orthogonal to the actual verification.

/Simon

---

From: Russ Housley <[email-masked]>
Date: Wed, 20 Feb 2008 09:16:02 -0500

Sean:

Given the proposed text, it sounds like you really want to say that 
key sizes from 768 to 2048 bits must be supported, even though you 
are recommending 1024 bits as the minimum for newly generated keys.

Russ

---

From: "Turner, Sean P." <[email-masked]>
Date: Wed, 20 Feb 2008 11:05:00 -0500

How about for 3851bis: A user agent SHOULD generate RSA key pairs at a
minimum key size of 1024 bits.  A user agent MUST NOT generate RSA key pairs
less than 1024 bits long.

I'll move the 768 back to 512 as suggested by Simon.

spt
>From: Russ Housley [mailto:[email-masked]] 
>Sent: Wednesday, February 20, 2008 9:16 AM
>To: Turner, Sean P.
>Cc: [email-masked]
>Given the proposed text, it sounds like you really want to say 
>that key sizes from 768 to 2048 bits must be supported, even 
>though you are recommending 1024 bits as the minimum for newly 
>generated keys.
>
>Russ
>
>>  If an S/MIME agent needs to generate an RSA key pair,  then the 
>> S/MIME agent or some related administrative  utility or function 
>> SHOULD generate RSA key pairs  using the following 
>guidelines.  A user 
>> agent SHOULD  generate RSA key pairs at a minimum key size of 1024
>>                                          was 768 ^^^^  bits.  A user 
>> agent MUST NOT generate RSA key pairs  less than 768 bits long. 
>> Creating keys longer than
>>            ^^^ was 512
>>  1024 bits can cause some older S/MIME receiving agents  to not be 
>> able to verify signatures, but gives better  security and is 
>therefore 
>> valuable.  A receiving agent  SHOULD be able to verify 
>signatures with 
>> keys of any  size over 768 bits. Some agents created in the United
>>            ^^^ was 512
>>  States have chosen to create 512 bit keys in order to  get more 
>> advantageous export licenses.  However, 512  bit keys are considered 
>> by many to be cryptographically  insecure. Implementers SHOULD be 
>> aware that multiple
>individual.  For 
>> example, one key pair can be used  to support 
>confidentiality, while a 
>> different key pair  can be used for authentication.
>>
>>Thoughts?
>>
>>spt
>>