Subject: Algorithm OIDs for SHA-256, SHA-384, SHA-512 and releated signatures

From: [email-masked] (Terry Hayes)
Date: Mon, 9 Sep 2002 15:42:43 -0700

Now that FIPS 180-2 will be effective in Feburary 2003, it's time to implement
them in cryptographic libraries and in protocol implementations. However
I have not been able to find official definitions of the OID values for these
new algorithms.

I've seen the following values proposed as the OIDs for the new SHA variants:

SHA-256:    2.16.840.1.101.3.4.2.1

SHA-384:    2.16.840.1.101.3.4.2.2

SHA-512:    2.16.840.1.101.3.4.2.3

My source for these called these values "provisional."  Is there an official
definition somewhere?

In addition to OIDs for the hash functions themselves, additional OIDs need
to be defined for other operations that use them.  In particular, a value
for sha-256WithRSAEncryption should be defined as soon as possible.  I expect
that this algorithm will become popular fairly quickly, replacing sha-1WithRSAEncryption
in deployments that want an effective security level of 128 bits.  sha-256WithRSAEncryption
should also be added to the PKIX algorithms RFC (probably as a SHOULD) at
the next opportunity.

Who will be defining sha-256WithRSAEncryption?

Terry Hayes

[email-masked]

---

From: David Hopwood <[email-masked]>
Date: Tue, 10 Sep 2002 02:52:28 +0000

-----BEGIN PGP SIGNED MESSAGE-----

Terry Hayes wrote:
> Now that FIPS 180-2 will be effective in Feburary 2003, it's time to
> implement them in cryptographic libraries and in protocol implementations.
> However I have not been able to find official definitions of the OID values
> for these new algorithms.
> 
> My source for these called these values "provisional."

That was probably me (see <http://www.users.zetnet.co.uk/hopwood/crypto/scan/>),
so I should say where I got those OIDs from. They come from two sources that
agree with each other:

 - decoding the DER given in the description of the EMSA3 encoding method in
   P1363a (since at least draft 7, I believe, but certainly in section 12.1.3
   of draft 10.5).

 - PKCS#1 v2.1 draft 2, section B.1, which says:

     id-SHA256 OBJECT IDENTIFIER ::=
       {joint-iso-itu-t(2) country(16) us(840) organization(1) gov(101) csor(3)
        nistalgorithm(4) hashalgs(2) 1 }

     id-SHA384 OBJECT IDENTIFIER ::=
       {joint-iso-itu-t(2) country(16) us(840) organization(1) gov(101) csor(3)
        nistalgorithm(4) hashalgs(2) 2 }

     id-SHA512 OBJECT IDENTIFIER ::=
       {joint-iso-itu-t(2) country(16) us(840) organization(1) gov(101) csor(3)
        nistalgorithm(4) hashalgs(2) 3 }

They *should* also be documented at <http://csrc.nist.gov/csor/algorithms.htm>,
but aren't. I got no response the last time I emailed NIST about this, although
that was some time ago.

The OIDs for the hash functions are of course different from the OIDs for the
corresponding RSA signature schemes, which are what Russ Housley posted.

The Google search <http://www.google.com/search?q=2.16.840.1.101.3.4.2.1>
seems to imply that some people have already been including these OIDs in
libraries and protocol drafts (e.g. the OpenPGP / RFC2440bis draft).

- -- 
David Hopwood <[email-masked]>

Home page & PGP public key: http://www.users.zetnet.co.uk/hopwood/
RSA 2048-bit; fingerprint 71 8E A6 23 0E D3 4C E5  0F 69 8C D4 FA 66 15 01
Nothing in this message is intended to be legally binding. If I revoke a
public key but refuse to specify why, it is because the private key has been
seized under the Regulation of Investigatory Powers Act; see www.fipr.org/rip