[CFRG] Re: I-D Action: draft-irtf-cfrg-rsa-guidance-01.txt

[Phillip Hallam-Baker <[e-mail]>]

Very interesting. RSA will be with us for a long time...

Have you considered key generation? Just adding a reference to FIPS 185-5
might be enough. I am currently trying to decide whether probabilistic or
provable primes are the way to go. I have also noticed that keygen on my
state of the art 2023 machine is taking almost as long as it used to take
in 1990. That is because we are using longer keys and we are doing a lot
more checks - the auxiliary primes.

On the draft itself, I am not sure about calling Montgomery ladders 'side
channel free'. They are really not. Hardware does too much weirdness these
days for anything to be side effect free unless it is hardware designed to
be so.



On Tue, Sep 3, 2024 at 2:27 PM Alicja Kario <[e-mail]> wrote:

> Hello,
>
> In the main body of the draft there were just few minor changes:
> few typos fixed.
>
> The main change in revision 01 is the addition of actual test vectors
> for the 2048 bit RSA key.
>
> As I've also wrote automated tests to verify the correctness of them,
> it took me a bit more than I expected, you can find those here:
> https://github.com/tlsfuzzer/tlslite-ng/pull/528
> That's also the reason why I haven't added test vectors for other
> key sizes yet.
>
> Please provide comments if this format of the test vectors is
> OK/acceptable, and I'll add the other key sizes a bit later.
>
> On Tuesday, 3 September 2024 20:13:17 CEST, [e-mail]
> wrote:
> > Internet-Draft draft-irtf-cfrg-rsa-guidance-01.txt is now available. It
> is a
> > work item of the Crypto Forum (CFRG) RG of the IRTF.
> >
> >    Title:   Implementation Guidance for the PKCS #1 RSA
> > Cryptography Specification
> >    Author:  Alicja Kario
> >    Name:    draft-irtf-cfrg-rsa-guidance-01.txt
> >    Pages:   23
> >    Dates:   2024-09-03
> >
> > Abstract:
> >
> >    This document specifies additions and amendments to RFC 8017.
> >    Specifically, it provides guidance to implementers of the standard to
> >    protect against side-channel attacks.  It also deprecates the RSAES-
> >    PKCS-v1_5 encryption scheme, but provides an alternative depadding
> >    algorithm that protects against side-channel attacks raising from
> >    users of vulnerable APIs.  The purpose of this specification is to
> >    increase security of RSA implementations.
> >
> > The IETF datatracker status page for this Internet-Draft is:
> > https://datatracker.ietf.org/doc/draft-irtf-cfrg-rsa-guidance/
> >
> > There is also an HTMLized version available at:
> > https://datatracker.ietf.org/doc/html/draft-irtf-cfrg-rsa-guidance-01
> >
> > A diff from the previous version is available at:
> >
> https://author-tools.ietf.org/iddiff?url2=draft-irtf-cfrg-rsa-guidance-01
> >
> > Internet-Drafts are also available by rsync at:
> > rsync.ietf.org::internet-drafts
> >
> >
>
> --
> Regards,
> Alicja (nee Hubert) Kario
> Principal Quality Engineer, RHEL Crypto team
> Web: www.cz.redhat.com
> Red Hat Czech s.r.o., Purkyňova 115, 612 00, Brno, Czech Republic
>
> _______________________________________________
> CFRG mailing list -- [e-mail]
> To unsubscribe send an email to [e-mail]
>