Subject: RE: Algorithm OIDs for SHA-256, SHA-384, SHA-512 and releated sig natures

From: "Singer, Ari" <[email-masked]>
Date: Tue, 10 Sep 2002 17:17:24 -0400

Hi, Terry and Russ.

This won't answer the question of the "official" source for the SHA-xxx
OIDs, but I will follow up with Tim to make sure that these are the correct
OIDs and include them (along with the new RSA OIDs that use them) in the
next draft of the supplemental algorithms draft as imported OIDs.  That
should suffice for the PKIX working group, at least.  The new draft will be
available before the Atlanta meeting.

Best regards,
Ari

Ari Singer, Principal Engineer
NTRU
5 Burlington Woods
Burlington, MA 01803
Main: (781) 418-2500
Personal: (781) 418-2515
Fax: (781) 418-2532

> -----Original Message-----
> From: Housley, Russ [mailto:[email-masked]]
> Sent: Tuesday, September 10, 2002 12:52 PM
> To: [email-masked]
> Cc: [email-masked]
> Subject: RE: Algorithm OIDs for SHA-256, SHA-384, SHA-512 and releated
> signatures
> 
> 
> 
> Terry:
> 
> It is my understanding from Tim Polk that these OIDs are 
> official.  I do 
> not know the method that will be used to publish them.
> 
> Russ
> 
> At 05:25 PM 9/9/2002 -0700, Terry Hayes wrote:
> >Thanks Russ for the pointers to the new RSA values.  I 
> hadn't noticed the 
> >June update to PKCS #1.
> >
> >I see that the latest PKCS #1 update, the lastest S/MIME 
> RSAES-OAEP draft 
> >and the latest PKIX supplimental algorithms draft all refer 
> to the new 
> >hash algorithms using the OIDs that I had seen previously.
> >
> >Is there any timetable for an official publication of these 
> OIDs, perhaps 
> >on the CSOR page at NIST 
> >(<http://csrc.nist.gov/csor/algorithms.htm>http://csrc.nist.g
> ov/csor/algorithms.htm)?
> >
> >Terry
> >
> >Housley, Russ wrote:
> >
> >>Terry:
> >>
> >>The most recent PKCS#1 ASN.1 module includes:
> >>
> >>    --
> >>    -- When the following OIDs are used in an 
> AlgorithmIdentifier the
> >>    -- parameters MUST be present and MUST be NULL.
> >>    --
> >>    md2WithRSAEncryption       OBJECT IDENTIFIER ::= { pkcs-1 2 }
> >>    md5WithRSAEncryption       OBJECT IDENTIFIER ::= { pkcs-1 4 }
> >>    sha1WithRSAEncryption      OBJECT IDENTIFIER ::= { pkcs-1 5 }
> >>    sha256WithRSAEncryption    OBJECT IDENTIFIER ::= { pkcs-1 11 }
> >>    sha384WithRSAEncryption    OBJECT IDENTIFIER ::= { pkcs-1 12 }
> >>    sha512WithRSAEncryption    OBJECT IDENTIFIER ::= { pkcs-1 13 }
> >>
> >>
> >>Russ
> >>
> >>
> >>
> >>-----Original Message-----
> >>From: <mailto:[email-masked]>[email-masked]
> >>To: <mailto:[email-masked]>[email-masked]
> >>Sent: 9/9/02 6:42 PM
> >>Subject: Algorithm OIDs for SHA-256, SHA-384, SHA-512 and releated
> >>signatures
> >>
> >>Now that FIPS 180-2 will be effective in Feburary 2003, it's time to
> >>implement them in cryptographic libraries and in protocol
> >>implementations. However I have not been able to find official
> >>definitions of the OID values for these new algorithms.
> >>
> >>I've seen the following values proposed as the OIDs for the new SHA
> >>variants:
> >>
> >>     SHA-256:    2.16.840.1.101.3.4.2.1
> >>     SHA-384:    2.16.840.1.101.3.4.2.2
> >>     SHA-512:    2.16.840.1.101.3.4.2.3
> >>
> >>My source for these called these values "provisional."  Is there an
> >>official definition somewhere?
> >>
> >>In addition to OIDs for the hash functions themselves, 
> additional OIDs
> >>need to be defined for other operations that use them.  In 
> particular, a
> >>value for sha-256WithRSAEncryption should be defined as soon as
> >>possible.  I expect that this algorithm will become popular fairly
> >>quickly, replacing sha-1WithRSAEncryption in deployments 
> that want an
> >>effective security level of 128 bits.  
> sha-256WithRSAEncryption should
> >>also be added to the PKIX algorithms RFC (probably as a 
> SHOULD) at the
> >>next opportunity.
> >>
> >>Who will be defining sha-256WithRSAEncryption?
> >>
> >>Terry Hayes
> >><mailto:[email-masked]>[email-masked] 
<mailto:[email-masked]>

---

From: Tim Polk <[email-masked]>
Date: Thu, 12 Sep 2002 10:16:35 -0400

Folks,

The SHA-xxx OIDs identified by Terry are "official" in that they are 
NIST-assigned OIDs from the NIST arc.  These OIDs were assigned based on a 
draft published a few years back, rather than an official NIST publication, 
which is probably why Terry had noted them as provisional.  The OIDs were 
official; the algorithms were not... if the FIPS differed from the draft 
algorithm specification, I intended to issue new OIDs.  (That is also why I 
had not promoted them on the CSOR web pages.)

However, the new secure hash FIPS was issued in August, and the algorithms 
are exactly those defined in the draft specification.   (BTW, the new FIPS 
is available at 
http://csrc.nist.gov/publications/fips/fips180-2/fips180-2.pdf).   There is 

 > >>     SHA-512:    2.16.840.1.101.3.4.2.3

Clearly, updates to my OID pages are overdue.  I will specify the new SHA 
oids and point to PKCS #1 for the new RSA with SHA-xxx signature algorithm 
oids.  I'm glad to see those have been assigned!

I will also talk to NIST's X9 representatives about  signature OIDs for 
ECDSA with the new hashes, and OIDs for a revised digital signature 
algorithm with larger key sizes (when available).  It doesn't matter to me 
who assigns them; the important thing is that there be just one...   X9 
assigned the previous OIDs, so maybe they'll want to handle these as 
well.  If they can't move quickly enough, I will assign them.  (That 
creates a new problem of course - convincing X9 to specify the NIST oids.)

Thanks,

Tim Polk