Subject: [ietf-tls] Straw poll on RSA-OAEP (Last call: AES ciphersuites for TLS)

From: David Hopwood <[email-masked]>
Date: Fri, 20 Jul 2001 23:02:59 +0100

-----BEGIN PGP SIGNED MESSAGE-----

"Housley, Russ" wrote:
> I agree with Bodo's point. If the same private key is used with both
> RSA-OAEP and PKCS #1 v1.5, it can be attacked via the weaker
> method.  However, this is not a reason to delay the introduction of
> RSA-OAEP; eventually the server can support just AES with RSA-OAEP.

I think it is a good reason to delay. All of the key exchange algorithms
should really be thoroughly re-analysed from the point of view of both
security and efficiency. There are several possibilities for improving
speed and forward secrecy properties. We certainly can't do such an
analysis in one week.

If we introduce RSA-OAEP now as specified in the draft, and then find
that there was a better way of doing so (which is likely), are we then
going to add yet another RSA key exchange variant later?

I've just checked that there were no changes between drafts -03 and -04
apart from RSA-OAEP (and a change to Pete Chown's phone number). So,
I formally propose that it should be draft-ietf-tls-ciphersuite-03.txt
(with the phone number change) that is taken to Proposed Standard RFC,
not -04.

Some people have already made their position clear:

For draft -04, with RSA-OAEP:
  Russ Housley <[email-masked]>

For draft -03, with PKCS #1 v1.5:
  David Hopwood <[email-masked]>
  Terry Hayes <[email-masked]>, speaking for Netscape
  Bodo Möller <[email-masked]>

Against draft -04 (does this mean for draft -03?):
  Dr S N Henson <[email-masked]>
  Eric Rescorla <[email-masked]>

(If I've misinterpreted anyone's position, please say so.)

- -- 
David Hopwood <[email-masked]>

Home page & PGP public key: http://www.users.zetnet.co.uk/hopwood/
RSA 2048-bit; fingerprint 71 8E A6 23 0E D3 4C E5  0F 69 8C D4 FA 66 15 01
Nothing in this message is intended to be legally binding. If I revoke a
public key but refuse to specify why, it is because the private key has been
seized under the Regulation of Investigatory Powers Act; see www.fipr.org/rip

---
You are currently subscribed to ietf-tls as: [email-masked]
To unsubscribe send a blank email to [email-masked]

---

From: Dr S N Henson <[email-masked]>
Date: Sat, 21 Jul 2001 01:16:32 +0100

>   Dr S N Henson <[email-masked]>

Yes it does mean that in my case.

Steve.
-- 
Dr Stephen N. Henson.   http://www.drh-consultancy.demon.co.uk/
Personal Email: [email-masked] 
Senior crypto engineer, Celo Communications: http://www.celocom.com/
Core developer of the   OpenSSL project: http://www.openssl.org/
Business Email: [email-masked] PGP key: via homepage.

---

---

From: Dean Povey <[email-masked]>
Date: Mon, 23 Jul 2001 09:22:44 +1000

>  Bodo Möller <[email-masked]>

I'd also like to support draft-03 with PKCS#1 v1.5 for all the reasons 
stated.  I think that OAEP should be added to TLS, but should not be 
mandatory with AES.

Cheers.

-- 
Dean Povey,         | e-m: [email-masked] | JCSI: Java Crypto Toolkit 
Research Scientist  | ph:  +61 7 3864 5120   | uPKI: C PKI toolkit for embedded
Security Unit, DSTC | fax: +61 7 3864 1282   |       systems
Brisbane, Australia | www: security.dstc.com | 

---