Re: [Cfrg] FIPS or equivalent approvals

[Phillip Hallam-Baker <[e-mail]>]

On Tue, Jul 29, 2014 at 11:45 AM, Salz, Rich <[e-mail]> wrote:
>> If we are going to use the new curves in PKIX (a major part of TLS) we are
>> going to need trustworthy HSMs.
>
> I disagree with the idea that PKIX is a major part of TLS, the implication that RSA 2K certs need to be replaced quickly, and that HSM's are needed by the CA's.
>
> Other then that, the sentence is fine. :)

That depends on your definition of 'quickly'. I don't intend to do
this according to the 'waterfall' development model where anyone who
looks ahead more than one problem at a time gets told to wait for what
turns out to be three years for a decision. We have seen the result of
that approach in IPv6 and DNSSEC.

If this group wants to make the decision it is going to have to allow
for parallel processing of things that can be done in parallel. It
will take a little while for the hardware folk to take notice. And
some of those vendors have expertise that I think is rather useful,
they have been facing issues such as side channels for a long time.


Given that this is essentially a bikeshedding decision process, one of
the criteria is going to be which curve's supporters is willing to do
most to persuade people that they will win.

As for CAs not needing HSMs, I don't think any of the browser
providers is going to accept a root that is not protected by some
FIPS-140 equivalent validated HSM with multiple separation of duties
controls.


We will need the whole industry on board in the end. At least in
nCipher, Aladdin, Intel, AMD, ARM etc are asked early on they won't
have an excuse to complain later.

Making the approach is a signal to their people to think about
planning to put some of this stuff on their roadmaps.