From nobody Tue Apr 12 01:38:29 2022 Return-Path: X-Original-To: dnsop@ietfa.amsl.com Delivered-To: dnsop@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id AA5BD3A06E7 for ; Tue, 12 Apr 2022 01:38:27 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, SPF_PASS=-0.001, T_KAM_HTML_FONT_INVALID=0.01, T_SCC_BODY_TEXT_LINE=-0.01, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id MhBWjk0PbLPe for ; Tue, 12 Apr 2022 01:38:23 -0700 (PDT) Received: from cnnic.cn (smtp13.cnnic.cn [218.241.118.13]) by ietfa.amsl.com (Postfix) with ESMTP id D12C43A077C for ; Tue, 12 Apr 2022 01:38:20 -0700 (PDT) Received: from CNNIC-PC (unknown [218.241.111.115]) by ocmail02.zx.nicx.cn (Coremail) with SMTP id AQAAf0BZYXl4OlVi7hxZAA--.4635S2; Tue, 12 Apr 2022 16:38:16 +0800 (CST) Date: Tue, 12 Apr 2022 16:38:17 +0800 From: zhangcuiling To: "Paul Wouters" Cc: dnsop References: <202204111111585901567@cnnic.cn>, <4af2f29f-b2ac-b2e7-e977-793461adfda5@nohats.ca> X-Priority: 3 X-Has-Attach: no X-Mailer: Foxmail 7.2.18.95[cn] Mime-Version: 1.0 Message-ID: <202204121637168708993@cnnic.cn> Content-Type: multipart/alternative; boundary="----=_001_NextPart321488411677_=----" X-CM-TRANSID: AQAAf0BZYXl4OlVi7hxZAA--.4635S2 X-Coremail-Antispam: 1UD129KBjvJXoWxAFy8KFW7GrW7WFy5uw1UGFg_yoW5Aw18pF Wxtw1ktaykJFnxGas2gw4xWayFvrZ5Gw4UGFn8JrWvywn8ZFnavryIkay5Way3Wrn3ZF1j qr4IvFyDAan8CaDanT9S1TB71UUUUUUqnTZGkaVYY2UrUUUUjbIjqfuFe4nvWSU5nxnvy2 9KBjDU0xBIdaVrnRJUUU9Gb7Iv0xC_Kw4lb4IE77IF4wAFF20E14v26r1j6r4UM7CY07I2 0VC2zVCF04k26cxKx2IYs7xG6rWj6s0DM7CIcVAFz4kK6r1j6r18M28lY4IEw2IIxxk0rw A2F7IY1VAKz4vEj48ve4kI8wA2z4x0Y4vE2Ix0cI8IcVAFwI0_Ar0_tr1l84ACjcxK6xII jxv20xvEc7CjxVAFwI0_Cr0_Gr1UM28EF7xvwVC2z280aVAFwI0_GcCE3s1l84ACjcxK6I 8E87Iv6xkF7I0E14v26rxl6s0DM2AIxVAIcxkEcVAq07x20xvEncxIr21l5I8CrVC2j2CE jI02ccxYII8I67AEr4CY67k08wAv7VC0I7IYx2IY67AKxVWUJVWUGwAv7VC2z280aVAFwI 0_Jr0_Gr1lOx8S6xCaFVCjc4AY6r1j6r4UM4x0Y48IcxkI7VAKI48JM4xvF2IEb7IF0Fy2 64kE64k0F24lc2xSY4AK67AK6r43MxAIw28IcxkI7VAKI48JMxC20s026xCaFVCjc4AY6r 1j6r4UMI8I3I0E5I8CrVAFwI0_JrI_JrWlx2IqxVCjr7xvwVAFwI0_JrI_JrWlx4CE17CE b7AF67AKxVWUXVWUAwCIc40Y0x0EwIxGrwCI42IY6xIIjxv20xvE14v26r1j6r1xMIIF0x vE2Ix0cI8IcVCY1x0267AKxVWUJVW8JwCI42IY6xAIw20EY4v20xvaj40_WFyUJVCq3wCI 42IY6I8E87Iv67AKxVWUJVW8JwCI42IY6I8E87Iv6xkF7I0E14v26r1j6r4UMVCEFcxC0V AYjxAxZFUvcSsGvfC2KfnxnUUI43ZEXa7IU5drcDUUUUU== X-CM-SenderInfo: x2kd0wxfxlzxlqj6u0xqlfhubq/ Archived-At: Subject: Re: [DNSOP] A new draft on SM2 digital signature algorithm for DNSSEC X-BeenThere: dnsop@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: IETF DNSOP WG mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 12 Apr 2022 08:38:28 -0000 This is a multi-part message in MIME format. ------=_001_NextPart321488411677_=---- Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 DQpNYW55IHRoYW5rcyBmb3IgcmVhZGluZyB0aGUgZHJhZnQuDQoNCj4gZnJvbTogIlBhdWwgV291 dGVycyIgPHBhdWxAbm9oYXRzLmNhPiBvbiBNb24sIDIwMjItMDQtMTENCj4gdG86IHpoYW5nY3Vp bGluZyA8emhhbmdjdWlsaW5nQGNubmljLmNuPg0KPiBjYzogZG5zb3AgPGRuc29wQGlldGYub3Jn Pg0KPiBzdWJqZWN0OiBSZTogW0ROU09QXSBBIG5ldyBkcmFmdCBvbiBTTTIgZGlnaXRhbCBzaWdu YXR1cmUgYWxnb3JpdGhtIGZvciBETlNTRUMNCj4gDQo+IE9uIE1vbiwgMTEgQXByIDIwMjIsIHpo YW5nY3VpbGluZyB3cm90ZToNCj4gDQo+ID4gQW5kIHRoZSBtYWluIHB1cnBvc2UgaXMgdG8gaW1w cm92ZSB0aGUgZGl2ZXJzaXR5IG9mIEROU1NFQyBhbGdvcml0aG1zLCBhbmQgdG8gbWFrZSBpdCBj b252ZW5pZW50IGZvciBwZW9wbGUgd2hvIHdhbnQgdG8gdXNlIFNNMg0KPiA+IGRpZ2l0YWwgc2ln bmF0dXJlIGFsZ29yaXRobSBhcyBhbiBhbHRlcm5hdGl2ZSBmb3IgRE5TU0VDLg0KPiANCj4gV2Ug YWN0dWFsbHkgd2FudCB0byBwcmV2ZW50IGFzIG11Y2ggZGl2ZXJzaXR5IGFzIHdlIGNhbiwgdG8g YXZvaWQNCj4gY3JlYXRpbmcgbW9yZSBuZXcgbG9uZyB0YWlscyBvZiBkZXBsb3ltZW50IG9mIGFs Z29yaXRobXMuIFNvIGEgbmV3DQoNClRoYXQgc291bmRzIHJlYXNvbmFibGUuIEl0IGRvZXMgbmVl ZCBhZGRpdGlvbmFsIHdvcmsgdG8gc3VwcG9ydCANClNNMiBEaWdpdGFsIFNpZ25hdHVyZSBBbGdv cml0aG0gZm9yIEROUyBzb2Z0d2FyZSBpbXBsZW1lbnRhdGlvbi4gDQpUaGUgZ29vZCBuZXdzIGlz IHRoYXQgT3BlbnNzbCBoYXMgc3VwcG9ydGVkIGl0IHNpbmNlIHZlcnNpb24gMS4xLjEuIA0KQW5k IEkgdGhpbmsgT3BlbnNzbCBpcyB3aWRlbHkgdXNlZCBhbW9uZyBETlMgc29mdHdhcmUuDQoNCj4g YWxnb3JpdGhtIHNob3VsZCByZWFsbHkgb2ZmZXIgc29tZXRoaW5nIHRoZSBvdGhlcnMgZG8gbm90 LiBBbHNvIGhhdmluZw0KPiBhIG51bWJlciBvZiBFQ0MgYmFzZWQgYWxnb3JpdGhtcyB3b3VsZCBs aWtlbHkgbWVhbiBpZiBvbmUgZW5kcyB1cA0KPiBicm9rZW4sIGFsbCBvZiB0aGVtIGVuZCB1cCBi cm9rZW4uDQo+IA0KPiBTbyBiYXNlZCBvbjoNCj4gDQo+ICAgRHVlIHRvIHRoZSBzaW1pbGFyaXR5 IGJldHdlZW4gU00yIGFuZCBFQ0RTQSB3aXRoIGN1cnZlIFAtMjU2LCBzb21lDQo+ICAgb2YgdGhl IG1hdGVyaWFsIGluIHRoaXMgZG9jdW1lbnQgaXMgY29waWVkIGxpYmVyYWxseSBmcm9tIFJGQyA2 NjA1DQo+ICAgW1JGQzY2MDVdLg0KPiANCj4gSSBkb24ndCBzZWUgYSBzdHJvbmcgcmVhc29uIHRv IGFkb3B0IGFub3RoZXIgRUNDIHR5cGUgb2YgYWxnb3JpdGhtLg0KDQpTb3JyeSB0aGF0IG1heWJl IEkgZGlkbid0IG1ha2UgaXQgY2xlYXIuIA0KDQpBYm91dCBTTTIgYW5kIEVDRFNBOg0KU00yIGFu ZCBFQ0RTQSBhcmUgc2ltaWxhciBpbiB0aGUgZm9sbG93aW5nIGFzcGVjdHM6IHRoZSBsZW5ndGgg b2YgdGhlIA0KcHJpdmF0ZSBrZXkgKDMyIG9jdGV0cyksIHB1YmxpYyBrZXkgKDY0IG9jdGV0cykg YW5kIHRoZSBzaWduYXR1cmUgDQooNjQgb2N0ZXRzKSBhcmUgdGhlIHNhbWUuIA0KQnV0IHRoZXJl IGlzIGFuIGltcG9ydGFudCBkaWZmZXJlbmNlIGJldHdlZW4gdGhlc2UgdHdvIGFsZ29yaXRobXMs IA0Kd2hpY2ggaXMgdGhlIHByb2Nlc3Mgb2Ygc2lnbmF0dXJlIGNhbGN1bGF0aW9uLiBTbyBTTTIg aXMgYSBkaWZmZXJlbnQgDQphbGdvcml0aG0gZnJvbSBFQ0RTQS4NCkJ5IHRoZSB3YXksIGNvbXBh cmVkIHRvIGEgdG90YWxseSBkaWZmZXJlbnQgYWxnb3JpdGhtLCANCnRoZSBzaW1pbGFyaXR5IGJl dHdlZW4gU00yIGFuZCBFQ0RTQSBjYW4gcmVkdWNlIHRoZSBjb21wbGljYXRpb24gb2YgDQpzdXBw b3J0aW5nIFNNMiB0byBzb21lIGV4dGVudC4NCg0KQWJvdXQgdGhlIHNlY3VyaXR5IG9mIEVDQy1i YXNlZCBhbGdvcml0aG1zOg0KQXMgZmFyIGFzIEkga25vdywgdGhlIHNlY3VyaXR5IG9mIEVDQy1i YXNlZCBhbGdvcml0aG1zIGlzIHN0cm9uZ2x5IA0KaW5mbHVlbmNlZCBieSB0aGUgY3VydmUgaXQg dXNlcy4gU29tZXRpbWVzIGl0J3MgaGFyZCB0byBzYXkgd2hpY2ggDQpjdXJ2ZSBpcyBtdWNoIHNh ZmVyLiBFbGxpcHRpYyBjdXJ2ZSBzZWNwMjU2cjEgKGZvciBETlNTRUMpIGFuZCANCnNlY3AyNTZr MSAoZm9yIGJsb2NrY2hhaW4pIGFyZSByZWxhdGl2ZWx5IHBvcHVsYXIgZm9yIEVDRFNBLiANCg0K U00yIHVzZXMgYSBkaWZmZXJlbnQgY3VydmUgYW5kIGhhcyBkaWZmZXJlbnQgcHJvY2VzcyB3aXRo IHRoZSBzaWduYXR1cmUNCmdlbmVyYXRpb24gYW5kIHZhbGlkYXRpb24sIHNvIEknZCBsaWtlIHRv IGNvbnNpZGVyIGl0IGFzIGFuIGFsdGVybmF0aXZlDQp0byBFQ0RTQS4NCg0KPiANCj4gQWRkaXRp b25hbGx5LCBpbiB0aGlzIGNhc2UgU00yL1NNMyBzZWVtcyB0byBiZSBJU08gc3RhbmRhcmRzIHRo YXQgYXJlDQo+IG5vdCBmcmVlbHkgYXZhaWxhYmxlLCBzbyB0aGVzZSBhcmUgYWRkaXRpb25hbGx5 IHByb2JsZW1hdGljLg0KPiANCg0KSSBhZ3JlZSB3aXRoIHlvdS4gSSBzaG91bGQgc3BlY2lmeSBh IGRvY3VtZW50IHRoYXQgY291bGQgYmUgZG93bmxvYWRlZCBmcmVlbHkuDQpIZXJlIGlzIGFub3Ro ZXIgb25lIGludHJvZHVjaW5nIFNNMi9TTTMgaW4gZGV0YWlsOg0KIkluZm9ybWF0aW9uIHNlY3Vy aXR5IHRlY2hub2xvZ3kgLS0tIFB1YmxpYyBrZXkgY3J5cHRvZ3JhcGhpYyBhbGdvcml0aG0gDQpT TTIgYmFzZWQgb24gZWxsaXB0aWMgY3VydmVzIC0tLSBQYXJ0IDI6IERpZ2l0YWwgc2lnbmF0dXJl IGFsZ29yaXRobSINCmh0dHA6Ly93d3cuZ21iei5vcmcuY24vdXBsb2FkLzIwMTgtMDctMjQvMTUz MjQwMTY3MzEzODA1NjMxMS5wZGYNCkl0J3Mgd3JpdHRlbiBpbiBFbmdsaXNoLCBidXQgdW5mb3J0 dW5hdGVseSBpdCdzIG5vdCBhbiBpbnRlcm5hdGlvbmFsIHN0YW5kYXJkLg0KSSB3aWxsIGtlZXAg b24gdHJ5aW5nIHRvIGZpbmQgYSBtb3JlIHByb3BlciBkb2N1bWVudC4NCg0KVGhhbmsgeW91IGFn YWluIGZvciB5b3VyIHRpbWUgYW5kIHlvdXIgaGVscGZ1bCBjb21tZW50Lg0KDQpCZXN0IHJlZ2Fy ZHMsDQoNCkNhdGh5IFpoYW5nDQo= ------=_001_NextPart321488411677_=---- Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: quoted-printable
Many thanks= for reading the draft.

> from: "Paul Wouters" <paul@nohats.ca> on Mon, = 2022-04-11
> to: zhangcuiling &= lt;zhangcuiling@cnnic.cn>
> cc: dn= sop <dnsop@ietf.org>
> subject: = Re: [DNSOP] A new draft on SM2 digital signature algorithm for DNSSEC
> 
> On Mon, 11 Apr 2022, zhangcuiling wrote:
> 
> > And the main = purpose is to improve the diversity of DNSSEC algorithms, and to make it c= onvenient for people who want to use SM2
> > digital signature algorithm as an alternative for DNSSEC.
=
> 
&g= t; We actually want to prevent as much diversity as we can, to avoid
=
> creating more new long tails of deploymen= t of algorithms. So a new

That sounds reasonable. It does need additional wo= rk to support 
SM2 Digital Signatur= e Algorithm for DNS software implementation. 
The good news is that Openssl has supported it since version 1.1= .1. 
And I think Openssl is widely= used among DNS software.

> algorithm should really offer something the o= thers do not. Also having
> a number = of ECC based algorithms would likely mean if one ends up
> broken, all of them end up broken.
> 
> So bas= ed on:
> 
>   Due to the similarity between SM2 and ECDSA with curve P-2= 56, some
>   of the material in this docu= ment is copied liberally from RFC 6605
&g= t;   [RFC6605].
> 
> I don't see a strong reason to adopt another ECC ty= pe of algorithm.

Sorry that maybe I didn't make it clear. 

About SM2 and = ECDSA:
SM2 and ECDSA are similar in the= following aspects: the length of the 
private key (32 octets), public key (64 octets) and the signature =
(64 octets) are the same. 
But there is an important difference between thes= e two algorithms, 
which is the proc= ess of signature calculation. So SM2 is a different 
algorithm from ECDSA.
By the way, compared to a totally different algorithm, 
the similarity between SM2 and ECDSA can reduce the c= omplication of 
supporting SM2 to so= me extent.

About the security of ECC-based algorithms:
As far as I know, the security of ECC-based algorithms is stro= ngly 
influenced by the curve it us= es. Sometimes it's hard to say which 
secp256k1 (for blockchain) are relatively po= pular for ECDSA. 

SM2 uses a different curve and has different process = with the signature
generation and valid= ation, so I'd like to consider it as an alternative
to ECDSA.

> 
> Additi= onally, in this case SM2/SM3 seems to be ISO standards that are
> not freely available, so these are additionall= y problematic.
> 

I agree with you.= I should specify a document that could be downloaded freely.
Here is another one introducing SM2/SM3 in detail:
"Information security technology --- Public= key cryptographic algorithm 
SM2 b= ased on elliptic curves --- Part 2: Digital signature algorithm"
http://www.gmbz.org.cn/upload/2018-07-24/153240167= 3138056311.pdf
It's written in English, b= ut unfortunately it's not an international standard.
I will keep on trying to find a more proper document.

Thank you a= gain for your time and your helpful comment.

Best regards,

Cathy Zhang
------=_001_NextPart321488411677_=------