Subject: [jose] (REDO) POLL: RSA-OAEP/RSA-PSS default parameters

From: Karen O'Donoghue <[email-masked]>
Date: Wed, 29 Aug 2012 17:29:37 -0400

Folks,

Given the confusion around the original version of this poll, I'd like 
to try again.

The basic question is unchanged, the room count from Vancouver has been 
corrected, and a clarification regarding the status of SHA1 in the OAEP 
specification has been added.  For those of you who voted and feel you 
may have misunderstood the question or voted incorrectly, please feel 
free to update your answer.

Question:
Should SHA1 (and mgf1SHA1) be the default parameters for these algorithms?
Note:  These are the default parameters specified in RFC 3447, Section 
A.2.1, and are widely deployed.

Room vote:  5 yes, 0 no, 3 discuss

Thanks,
Karen

---

From: Brian Campbell <[email-masked]>
Date: Wed, 29 Aug 2012 15:57:33 -0600

yes (I can't honestly remember if I voted in Vancouver but I'm pretty
sure I abstained on this one at that time)

On Wed, Aug 29, 2012 at 3:29 PM, Karen O'Donoghue <[email-masked]> wrote:
> Folks,
>
> Given the confusion around the original version of this poll, I'd like to
> try again.
>
> specification has been added.  For those of you who voted and feel you may
> have misunderstood the question or voted incorrectly, please feel free to
> update your answer.
>
> Question:
> _______________________________________________
> jose mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/jose

---

From: Edmund Jay <[email-masked]>
Date: Wed, 29 Aug 2012 15:20:59 -0700 (PDT)

YES

________________________________
From: Karen O'Donoghue <[email-masked]>
To: [email-masked]
Sent: Wed, August 29, 2012 2:29:43 PM
Subject: [jose] (REDO) POLL: RSA-OAEP/RSA-PSS default parameters

Folks,

Given the confusion around the original version of this poll, I'd like to try 
again.

The basic question is unchanged, the room count from Vancouver has been 
corrected, and a clarification regarding the status of SHA1 in the OAEP 
specification has been added.  For those of you who voted and feel you may have 
misunderstood the question or voted incorrectly, please feel free to update your 
answer.

Question:
Should SHA1 (and mgf1SHA1) be the default parameters for these algorithms?
Note:  These are the default parameters specified in RFC 3447, Section A.2.1, 
and are widely deployed.

Thanks,
Karen

---

From: "Manger, James H" <[email-masked]>
Date: Thu, 30 Aug 2012 09:58:21 +1000

> Should SHA1 (and mgf1SHA1) be the default parameters for these

We don’t have "algorithm parameters" in JOSE – that is the subject of a separate POLL ("Support multiple types for algorithms"). JOSE currently has algorithm labels with no parameters.

Consequently this question is really asking one of the following:

Q1. Should RSA OAEP with SHA-1 be defined for use with JOSE? Perhaps additionally, should it be mandatory to implement?
The core of this question is whether SHA-1 is cryptographically-compromised enough that we shouldn't use it in new crypto specs, or is its widespread-availability more important than any crypto weakness?

Q2. Should the label "RSA-OAEP" be used for RSA OAEP with SHA-1?

My answer to Q2 is NO. The "RSA-OAEP" label is inconsistent with other JOSE alg names. JWA specifies "HS512", "RS512", "ES512", and "CS512" where the Sxxx suffix indicates a hash algorithm. RSA OAEP with SHA-1 could use "ROS1" or "ROS160".

--
James Manger

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On Behalf Of
> Karen O'Donoghue
> Sent: Thursday, 30 August 2012 7:30 AM
> To: [email-masked]

---

From: Breno de Medeiros <[email-masked]>
Date: Wed, 29 Aug 2012 17:00:46 -0700

Concur with the analysis that 'RSA-OAEP' terminology appears inconsistent
with other acronym usage.

On Wed, Aug 29, 2012 at 4:58 PM, Manger, James H <
[email-masked]> wrote:

> We don’t have "algorithm parameters" in JOSE – that is the subject of a
> separate POLL ("Support multiple types for algorithms"). JOSE currently has
> algorithm labels with no parameters.
>
> Q1. Should RSA OAEP with SHA-1 be defined for use with JOSE? Perhaps
> additionally, should it be mandatory to implement?
> The core of this question is whether SHA-1 is
> cryptographically-compromised enough that we shouldn't use it in new crypto
> specs, or is its widespread-availability more important than any crypto
> weakness?
>
> My answer to Q2 is NO. The "RSA-OAEP" label is inconsistent with other
> JOSE alg names. JWA specifies "HS512", "RS512", "ES512", and "CS512" where
> the Sxxx suffix indicates a hash algorithm. RSA OAEP with SHA-1 could use
> "ROS1" or "ROS160".
>
> --
> James Manger
>

-- 
--Breno

---

From: Stephen Farrell <[email-masked]>
Date: Thu, 30 Aug 2012 01:04:55 +0100

> The core of this question is whether SHA-1 is cryptographically-compromised enough that we shouldn't use it in new crypto specs, or is its widespread-availability more important than any crypto wea…

Just on this part. DKIM and DANE both decided to go with to
sha256 as the mandatory to implement digest alg. I think that
is a trend.

I don't see why JOSE would be different in that respect. If
JOSE do choose to stand out from the crowd and go with sha1
then I think you'll need to justify that explicitly and
convincingly.

S.

---

From: Mike Jones <[email-masked]>
Date: Thu, 30 Aug 2012 00:06:41 +0000

Where a key size is required to fully specify the algorithm, it's included in the name.  Examples:  HS256, A128GCM.
Where the size isn't required to fully specify the algorithm, it isn't.  Examples:  RSA1_5, RSA-OAEP, ECSH-ES.

No inconsistency.

                                                            -- Mike

From: [email-masked] [mailto:[email-masked]] On Behalf Of Breno de Medeiros
Sent: Wednesday, August 29, 2012 5:01 PM
To: Manger, James H
Cc: [email-masked]
Subject: Re: [jose] (REDO) POLL: RSA-OAEP/RSA-PSS default parameters

Concur with the analysis that 'RSA-OAEP' terminology appears inconsistent with other acronym usage.

> Should SHA1 (and mgf1SHA1) be the default parameters for these
We don't have "algorithm parameters" in JOSE - that is the subject of a separate POLL ("Support multiple types for algorithms"). JOSE currently has algorithm labels with no parameters.

--
James Manger

> From: [email-masked]<mailto:[email-masked]> [mailto:[email-masked]<mailto:[email-masked]>] On Behalf Of
> Karen O'Donoghue
> To: [email-masked]<mailto:[email-masked]>
> [email-masked]<mailto:[email-masked]>
_______________________________________________
jose mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/jose

--
--Breno

---

From: "Manger, James H" <[email-masked]>
Date: Thu, 30 Aug 2012 10:11:00 +1000

So what about RS256, RS384, and RS512?

--
James Manger

From: Mike Jones [mailto:[email-masked]]
Sent: Thursday, 30 August 2012 10:07 AM
To: Breno de Medeiros; Manger, James H
Cc: [email-masked]
Subject: RE: [jose] (REDO) POLL: RSA-OAEP/RSA-PSS default parameters

Where a key size is required to fully specify the algorithm, it’s included in the name.  Examples:  HS256, A128GCM.
Where the size isn’t required to fully specify the algorithm, it isn’t.  Examples:  RSA1_5, RSA-OAEP, ECSH-ES.

No inconsistency.

                                                            -- Mike

From: [email-masked]<mailto:[email-masked]> [mailto:[email-masked]] On Behalf Of Breno de Medeiros
Sent: Wednesday, August 29, 2012 5:01 PM
To: Manger, James H
Cc: [email-masked]<mailto:[email-masked]>
Subject: Re: [jose] (REDO) POLL: RSA-OAEP/RSA-PSS default parameters

--
James Manger

--
--Breno

---

From: John Bradley <[email-masked]>
Date: Wed, 29 Aug 2012 20:21:20 -0400

To clarify we are talking about the internal hash algorithm for the OAEP or PSS padding calculation and NOT the hash of the size of the hash for the message or the size of the key for AES.

In most cases the internal hash size is not exposed but baked in to OAEP and PSS calculation.

If we were talking about making SHA1 the default hash size for RSA signatures I would be opposed to this, but we are talking about a internal of the padding calculation. 
I have not seen any indication that SHA1 is in any way compromised for that use.   

My vote was to make SHA1 the hash function used for PSS/OAEP padding in the RSA-OAEP and RSA-PSS algorithms.

The size of the hash for signing and the size of the key for encryption are separate issues.

John B.

On 2012-08-29, at 8:06 PM, Mike Jones <[email-masked]> wrote:

> On Wed, Aug 29, 2012 at 4:58 PM, Manger, James H <[email-masked]> wrote:

---

From: Mike Jones <[email-masked]>
Date: Thu, 30 Aug 2012 00:31:36 +0000

They’re in the first category, in which a key size is required to fully specify the algorithm.

From: [email-masked] [mailto:[email-masked]] On Behalf Of Manger, James H
Sent: Wednesday, August 29, 2012 5:11 PM
To: Mike Jones; Breno de Medeiros
Cc: [email-masked]
Subject: Re: [jose] (REDO) POLL: RSA-OAEP/RSA-PSS default parameters

--
James Manger

From: Mike Jones [mailto:[email-masked]]<mailto:[mailto:[email-masked]]>

No inconsistency.

                                                            -- Mike

--
James Manger

--
--Breno

---

From: "Manger, James H" <[email-masked]>
Date: Thu, 30 Aug 2012 11:13:22 +1000

There is no 384-bit key involved in RS384 (RSASSA-PKCS1-V1_5 with SHA-384). It involves, say, a 2048-bit RSA key.

When you say “key size” do you actually mean “important size”, instead of “size of a crypto key”?

Perhaps the hash size and hash algorithm are “more important” in an RSA signature than in an RSA encryption padding scheme, though that is a fairly subtle hair to be splitting when naming JOSE algorithms. We would need to stop talking about “hash algorithms” and start talking about, say, “collision-resistant hash algorithms” and “pseudorandom functions” if we want to split that hair.
--
James Manger

From: [email-masked] [mailto:[email-masked]] On Behalf Of Mike Jones
Sent: Thursday, 30 August 2012 10:32 AM
To: Manger, James H; Breno de Medeiros
Cc: [email-masked]
Subject: Re: [jose] (REDO) POLL: RSA-OAEP/RSA-PSS default parameters

From: [email-masked]<mailto:[email-masked]> [mailto:[email-masked]] On Behalf Of Manger, James H

--
James Manger

No inconsistency.

                                                            -- Mike

--
James Manger

--
--Breno

---

From: Mike Jones <[email-masked]>
Date: Thu, 30 Aug 2012 01:33:38 +0000

Sure.  s/key size/size/g in my description below.  Sometimes the sizes are for things like hash function output size, rather than key size.

From: Manger, James H [mailto:[email-masked]]
Sent: Wednesday, August 29, 2012 6:13 PM
To: Mike Jones
Cc: [email-masked]
Subject: RE: [jose] (REDO) POLL: RSA-OAEP/RSA-PSS default parameters

--
James Manger

From: [email-masked]<mailto:[email-masked]> [mailto:[email-masked]]<mailto:[mailto:[email-masked]]> On Behalf Of Mike Jones

--
James Manger

No inconsistency.

                                                            -- Mike

--
James Manger

--
--Breno

---

From: Mike Jones <[email-masked]>
Date: Thu, 30 Aug 2012 01:52:21 +0000

Fair question.  I believe that the working group has been trying to choose algorithms that are commonly available and so can result in widely deployed interoperable implementations.  Implementability across common development platforms is a core goal.  The attached spreadsheet is part of the data gathered to help us choose which algorithms to include, and whether to make them REQUIRED/RECOMMENDED/OPTIONAL.  (I presented this in Vancouver, as you'll recall.)

BouncyCastle is the one library I'm aware of that supports both SHA-256 based and SHA-1 based OAEP parameters.  Windows native may as well.  (I know that .NET doesn't.)  I don't know about Ruby, Python, PHP, Java without BouncyCastle, Mac OS, Android, iOS, Windows Phone, node.js, RedHat, SUSE, ChromeOS, etc.  If the working group is interested, we could certainly do the investigation.

				-- Mike

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of Stephen Farrell
Sent: Wednesday, August 29, 2012 5:05 PM
To: Manger, James H
Cc: [email-masked]
Subject: Re: [jose] (REDO) POLL: RSA-OAEP/RSA-PSS default parameters

Just on this part. DKIM and DANE both decided to go with to
sha256 as the mandatory to implement digest alg. I think that is a trend.

I don't see why JOSE would be different in that respect. If JOSE do choose to stand out from the crowd and go with sha1 then I think you'll need to justify that explicitly and convincingly.

S.

---

From: Breno de Medeiros <[email-masked]>
Date: Thu, 30 Aug 2012 13:31:11 -0700

Right. The point here is that the RSA-OAEP standard itself allows for
parametrization of the hash function output size. While the vast majority
of current implementations use SHA-1, the standard itself allows for
arbitrary hash function specification. See
ftp://ftp.rsasecurity.com/pub/rsalabs/rsa_algorithm/rsa-oaep_spec.pdf,
section 1.3, paragraph 5.

On Wed, Aug 29, 2012 at 6:33 PM, Mike Jones <[email-masked]>wrote:

>  Sure.  s/key size/size/g in my description below.  Sometimes the sizes
> are for things like hash function output size, rather than key size.****
>
> ** **
>
> *From:* Manger, James H [mailto:[email-masked]]
> *Sent:* Wednesday, August 29, 2012 6:13 PM
> *To:* Mike Jones
>
> *Cc:* [email-masked]
> *Subject:* RE: [jose] (REDO) POLL: RSA-OAEP/RSA-PSS default parameters****
>
>  ** **
>
> There is no 384-bit key involved in RS384 (RSASSA-PKCS1-V1_5 with
> SHA-384). It involves, say, a 2048-bit RSA key.****
>
> ** **
>
> When you say “key size” do you actually mean “important size”, instead of
> “size of a crypto key”?****
>
> ** **
>
> Perhaps the hash size and hash algorithm are “more important” in an RSA
> signature than in an RSA encryption padding scheme, though that is a fairly
> subtle hair to be splitting when naming JOSE algorithms. We would need to
> stop talking about “hash algorithms” and start talking about, say,
> “collision-resistant hash algorithms” and “pseudorandom functions” if we
> want to split that hair.****
>
> ** **
>
> --****
>
> James Manger****
>
> ** **
>
> *From:* [email-masked] [mailto:[email-masked]] *On Behalf
> Of *Mike Jones
> *Sent:* Thursday, 30 August 2012 10:32 AM
> *To:* Manger, James H; Breno de Medeiros
> *Cc:* [email-masked]
> *Subject:* Re: [jose] (REDO) POLL: RSA-OAEP/RSA-PSS default parameters****
>
> ** **
>
> They’re in the first category, in which a key size is required to fully
> specify the algorithm.****
>
> ** **
>
> *From:* [email-masked] [mailto:[email-masked]<[email-masked]>]
> *On Behalf Of *Manger, James H
> *Sent:* Wednesday, August 29, 2012 5:11 PM
> *To:* Mike Jones; Breno de Medeiros
> *Cc:* [email-masked]
> *Subject:* Re: [jose] (REDO) POLL: RSA-OAEP/RSA-PSS default parameters****
>
> ** **
>
> So what about RS256, RS384, and RS512?****
>
> ** **
>
> --****
>
> James Manger****
>
> ** **
>
> *From:* Mike Jones [mailto:[email-masked]]
> *Sent:* Thursday, 30 August 2012 10:07 AM
> *To:* Breno de Medeiros; Manger, James H
> *Cc:* [email-masked]
> *Subject:* RE: [jose] (REDO) POLL: RSA-OAEP/RSA-PSS default parameters****
>
> ** **
>
> Where a key size is required to fully specify the algorithm, it’s included
> in the name.  Examples:  HS256, A128GCM.****
>
> Where the size isn’t required to fully specify the algorithm, it isn’t.
> Examples:  RSA1_5, RSA-OAEP, ECSH-ES.****
>
> ** **
>
> No inconsistency.****
>
> ** **
>
>                                                             -- Mike****
>
> ** **
>
> *From:* [email-masked] [mailto:[email-masked]<[email-masked]>]
> *On Behalf Of *Breno de Medeiros
> *Sent:* Wednesday, August 29, 2012 5:01 PM
> *To:* Manger, James H
> *Cc:* [email-masked]
> *Subject:* Re: [jose] (REDO) POLL: RSA-OAEP/RSA-PSS default parameters****
>
> ** **
>
> with other acronym usage.****
>
> ** **
>
> [email-masked]> wrote:****
>
> > Should SHA1 (and mgf1SHA1) be the default parameters for these
> > algorithms?****
>
> James Manger****
> >****
> https://www.ietf.org/mailman/listinfo/jose****
>
>
>
> ****
>
> ** **
>
> --
> --Breno****
>

-- 
--Breno