Subject: [cicm] OID for algorithm identifiers?

From: "Herzog, Jonathan - 0668 - MITLL" <[email-masked]>
Date: Tue, 8 Jun 2010 12:26:10 -0400

Perusing the CICM spec (http://tools.ietf.org/html/draft-lanz-cicm-00;
please let me know if there is a more recent version) I notice that it
apparently uses chracter-strings for identifying algorithms (Section
3.2.2.5). Really? Is there a structure to this name-space? Who manages it?

The CMS standard (Cryptographic Message Syntax, RFCs 5652 and 5754 among
many others) have settled on using OIDs for algorithm-identification, which
seems much saner. Not only are OIDs in a hierarchical ID-space, allowing
control over the name-space to be allocated and delegated among many
organizations, but it would allow CICM a greater compatibility with CMS and
its messages.

Or is there a downside to OIDs that I don't yet see?

Thanks.

-- 
Jonathan Herzog                      voice:  (781) 981-2356
Technical Staff                      fax:    (781) 981-7687
Cyber Systems and Technology Group   email:  [email-masked]
MIT Lincoln Laboratory               www:    http://www.ll.mit.edu/CST/
244 Wood Street    
Lexington, MA 02420-9185

---

From: "Blumenthal, Uri - 0668 - MITLL" <[email-masked]>
Date: Tue, 8 Jun 2010 12:28:39 -0400

The only downside (AFAIK) is OID size. Considering many advantages OID
offer, I'd say they should be used here.

Thanks!
-- 
Regards,
Uri
<Disclaimer>

---

From: "Novikov, Lev" <[email-masked]>
Date: Wed, 9 Jun 2010 16:29:14 -0400

On 2010-06-08 12:26, Jonathan Herzog wrote:
> [...] uses character-strings for identifying algorithms (Section

These are good points.

Do people know if the algorithms used in high assurance environments (e.g., Suite A in the US, or equivalent in other countries) are identified using OIDs?

If not, we might need some way to distinguish between algorithms identified using OIDs and those identified as plain strings. Or we could find out how to leverage the hierarchal nature of OIDs to help specify what the OID "should be" (or at least avoid conflict with the algorithms used by other organizations).

Other ideas?

Lev

---

From: Basil Dolmatov <[email-masked]>
Date: Thu, 10 Jun 2010 10:51:58 +0400

> If not, we might need some way to distinguish between algorithms identified using OIDs and those identified as plain strings. Or we could find out how to leverage the hierarchal nature of OIDs to h…
Better use OIDs, maybe having some means for creating plain string 
"aliases" for referring given OIDs

dol@

---

From: "Novikov, Lev" <[email-masked]>
Date: Wed, 16 Jun 2010 10:51:31 -0400

> "aliases" for referring given OIDs

Instead of aliases, I propose the following:

1. Algorithms SHOULD be named using their OID prefixed with "oid:"
2. Where an OID is unavailable, algorithms SHOULD be named with "name:" 
	followed by a human-readable algorithm name and mode separated with dashes.
	(This is the current method of naming algorithms in Section 4.1.3)

EXAMPLE:
SHA-256:
	"oid:2.16.840.1.101.3.4.2.1" (preferred)
OR	"name:SHA-256" (acceptable)

Regardless of which method is used, the exact strings available for use
MUST be documented in the Implementation Conformance Statement (ICS).

How does that sound?

Lev