Subject: [Curdle] I-D Action: draft-ietf-curdle-pkix-00.txt

From: [email-masked]
Date: Fri, 08 Apr 2016 20:26:59 -0700

A New Internet-Draft is available from the on-line Internet-Drafts directories.
This draft is a work item of the CURves, Deprecating and a Little more Encryption of the IETF.

        Title           : EdDSA, Ed25519, Ed448, Curve25519 and Curve448 for X.509
        Author          : Simon Josefsson
	Filename        : draft-ietf-curdle-pkix-00.txt
	Pages           : 12
	Date            : 2016-04-08

Abstract:
   This document specify algorithm identifiers and ASN.1 encoding
   formats for EdDSA digital signatures, subject public keys, and a
   "named curve" object identifier, used in the Internet X.509 Public
   Key Infrastructure.  Parameters for Ed25519, Ed25519ph, Ed448,
   Ed448ph, Curve25519 and Curve448 are defined.

The IETF datatracker status page for this draft is:
https://datatracker.ietf.org/doc/draft-ietf-curdle-pkix/

There's also a htmlized version available at:
https://tools.ietf.org/html/draft-ietf-curdle-pkix-00

Please note that it may take a couple of minutes from the time of submission
until the htmlized version and diff are available at tools.ietf.org.

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/

---

From: Anders Rundgren <[email-masked]>
Date: Sat, 9 Apr 2016 06:53:46 +0200

It seems that private keys now follows the scheme I proposed but it didn't
fully make it to the PEM sample in the draft.

Anders

On 2016-04-09 05:26, [email-masked] wrote:
> _______________________________________________
> Curdle mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/curdle
>

---

From: Ilari Liusvaara <[email-masked]>
Date: Sat, 9 Apr 2016 10:32:45 +0300

> https://tools.ietf.org/html/draft-ietf-curdle-pkix-00

Some questions / notes:

1) What is the public key format for each OID?

I presume:

id-Curve25519: X25519 format
id-Curve448: X448 format
id-Cure25519ph: ???Ed25519 format???
id-Curve448ph: ???Ed448 format???

id-EdDSAPublicKey/ed25519: Ed25519 format
id-EdDSAPublicKey/ed25519ph: Ed25519 format
id-EdDSAPublicKey/ed448 Ed448 format
id-EdDSAPublicKey/ed448ph: Ed448 format

But this assignment is odd, since there are NamedCurve entries
corresponding to Ed25519ph/Ed448ph keys but not Ed25519/Ed448
keys.

(The choises here are:
a) X25519 format (from RFC7748)
b) X448 format (from RFC7748)
c) Ed25519 format (from I.D-irtf-cfrg-eddsa)
d) Ed448 format (from I.D-irtf-cfrg-eddsa)
e) Other format (specify))

2) There is still example with 1.3.101.100.1 OID for the
signature, when prose says 1.3.101.101. Which one is correct?

-Ilari

---

From: Russ Housley <[email-masked]>
Date: Sun, 10 Apr 2016 11:10:28 -0400

The ASN.1 module does not compile.  Here is one that does:

   SafeCurves-PKIX-0 { 1 3 101 120 }

   DEFINITIONS ::= BEGIN

   id-EdDSAPublicKey OBJECT IDENTIFIER ::= { 1 3 101 100 }
   id-EdDSASignature OBJECT IDENTIFIER ::= { 1 3 101 101 }

   id-Curve25519   OBJECT IDENTIFIER ::= { 1 3 101 110 }
   id-Curve448     OBJECT IDENTIFIER ::= { 1 3 101 111 }
   id-Curve25519ph OBJECT IDENTIFIER ::= { 1 3 101 112 }
   id-Curve448ph   OBJECT IDENTIFIER ::= { 1 3 101 113 }

   EdDSAParameters ::= ENUMERATED {
       ed25519   (1),
       ed25519ph (2),
       ed448     (3),
       ed448ph   (4) }

   END

---

From: Daniel Kahn Gillmor <[email-masked]>
Date: Mon, 11 Apr 2016 17:13:59 -0400

> 	Filename        : draft-ietf-curdle-pkix-00.txt

Thanks for writing this and submitting it, Simon!

I note that section 7 (EdDSA signatures) doesn't mention anything about
a choice of context:

  https://tools.ietf.org/html/draft-ietf-curdle-pkix-00#section-7

The EdDSA CFRG draft makes it clear that a context string can be used
during signature creation and verification to avoid cross-protocol
attacks for other systems that use distinct context strings:

 https://tools.ietf.org/html/draft-irtf-cfrg-eddsa-05

I recommend explicitly selecting a context string for the use of EdDSA
in PKIX.  Perhaps the context string would just be "PKIX\0".

This would mean that the examples would probably need to change, but
since i don't think this is currently deployed, now is the time to make
that change.

Martin Thomson, Ben Kaduk and myself are in the process of writing up
the use of context strings as a best practice, and it would be great to
have more good examples to point at :)

     --dkg