Re: [Jose-reg-review] Request to register JOSE algorithms for the FIDO Alliance

[Mike Jones <[e-mail]>]

[Adding Giri, since he expressed interest in these registrations]

From: Jim Schaad <[e-mail]>
Sent: Friday, June 29, 2018 3:07 PM
To: 'Rolf Lindemann' <[e-mail]>; [e-mail]; [e-mail]
Cc: [e-mail]; Mike Jones <[e-mail]>; 'Hodges, Jeff' <[e-mail]>
Subject: RE: [Jose-reg-review] Request to register JOSE algorithms for the FIDO Alliance



From: Rolf Lindemann <[e-mail]<mailto:[e-mail]>>
Sent: Thursday, June 28, 2018 11:45 AM
To: 'Jim Schaad' <[e-mail]<mailto:[e-mail]>>; [e-mail]<mailto:[e-mail]>; [e-mail]<mailto:[e-mail]>
Cc: [e-mail]<mailto:[e-mail]>; [e-mail]<mailto:[e-mail]>; 'Hodges, Jeff' <[e-mail]<mailto:[e-mail]>>
Subject: AW: [Jose-reg-review] Request to register JOSE algorithms for the FIDO Alliance

Hi Jim,

Regarding your first question:
> One of the things that I would like to see would be the definition of a key structure as well.
I guess you are referring to the structure of the public keys (only).  Is that correct?
In the referenced document (i.e. https://fidoalliance.org/specs/fido-v2.0-id-20180227/fido-ecdaa-algorithm-v2.0-id-20180227.html#object-encodings), we define algorithms to encode the keys (e.g. ECPoint2ToB, ECPointToB).  The ECDAA issuer public keys consist of two values (typically denoted as X and Y) both of type ECPoint2 and hence would be serialized/encoded according to the definition of ECPoint2ToB.
Is this what you are looking for?

[JLS] I am looking for a JOSE key structure which would require defining a couple of things.  While I realize that you don't need it, it might also be useful to have the private key fields defined as well for the purposes of doing things like writing test cases such I have at https://github.com/jimsch/Examples.git You might have a good case for not needing one, but I would like to here what it is in that case.



Regarding your second question:
> I would like to verify that there is a requirement that the key size and hash size are combined together as a fixed pair and not uncoupled as done with the ECDSA algorithms where any sized key structure can be used with a specific hash and applications can be further restrictions as necessary.  If this is not the case, should the key set be made explicit rather than implicit in the algorithm name?

Yes, hash algorithm and signature algorithm are paired.  So we specify the following:

  1.  ED256: FIDO ECDAA algorithm based on TPM_ECC_BN_P256 [TPMv2-Part4] curve using SHA256 hash algorithm.
  2.  ED512: ECDAA algorithm based on ECC_BN_ISOP512 [ISO15946-5] curve using SHA512 algorithm.
  3.  ED638: ECDAA algorithm based on TPM_ECC_BN_P638 [TPMv2-Part4] curve using SHA512 algorithm.
  4.  ED256-2: ECDAA algorithm based on ECC_BN_DSD_P256 (https://fidoalliance.org/specs/fido-v2.0-id-20180227/fido-ecdaa-algorithm-v2.0-id-20180227.html#bib-DevScoDah2007) curve using SHA256 algorithm.

[JLS] Reading my last sentence, I see that I got my text backwards.  Should the Curve be part of the name rather than implicit so that there would be no mistakes.  The use of ED256-2 seems to be an odd name that does not necessarily provide good information.

Jim


Kind regards,
   Rolf

Von: Jim Schaad [mailto:[e-mail]]
Gesendet: Dienstag, 12. Juni 2018 18:31
An: [e-mail]<mailto:[e-mail]>; [e-mail]<mailto:[e-mail]>
Cc: [e-mail]<mailto:[e-mail]>; [e-mail]<mailto:[e-mail]>; 'Hodges, Jeff'
Betreff: RE: [Jose-reg-review] Request to register JOSE algorithms for the FIDO Alliance

Sorry about the delay, I got pulled into some other work and forgot that I had not sent a message.

One of the things that I would like to see would be the definition of a key structure as well.  I don't believe that you can use any of the current ones based on how things work.  Think about people who would use this algorithm in other protocols and need to transfer the root of trust as well.

I would like to verify that there is a requirement that the key size and hash size are combined together as a fixed pair and not uncoupled as done with the ECDSA algorithms where any sized key structure can be used with a specific hash and applications can be further restrictions as necessary.  If this is not the case, should the key set be made explicit rather than implicit in the algorithm name?



From: Rolf Lindemann <[e-mail]<mailto:[e-mail]>>
Sent: Friday, June 1, 2018 2:45 PM
To: 'Jim Schaad' <[e-mail]<mailto:[e-mail]>>; [e-mail]<mailto:[e-mail]>; [e-mail]<mailto:[e-mail]>
Cc: [e-mail]<mailto:[e-mail]>; [e-mail]<mailto:[e-mail]>; 'Hodges, Jeff' <[e-mail]<mailto:[e-mail]>>
Subject: AW: [Jose-reg-review] Request to register JOSE algorithms for the FIDO Alliance

Please see https://eprint.iacr.org/2015/1246 for that.

That is the reference included in the IANA considerations section of the document (see https://fidoalliance.org/specs/fido-v2.0-id-20180227/fido-ecdaa-algorithm-v2.0-id-20180227.html#iana-considerations)

Von: Jim Schaad [mailto:[e-mail]]
Gesendet: Freitag, 1. Juni 2018 22:25
An: [e-mail]<mailto:[e-mail]>; [e-mail]<mailto:[e-mail]>
Cc: [e-mail]<mailto:[e-mail]>; [e-mail]<mailto:[e-mail]>; 'Hodges, Jeff'
Betreff: RE: [Jose-reg-review] Request to register JOSE algorithms for the FIDO Alliance

Are there any crypto analysis papers that I can peruse in case I am interested?

From: Jose-reg-review <[e-mail]<mailto:[e-mail]>> On Behalf Of Rolf Lindemann
Sent: Friday, June 1, 2018 10:31 AM
To: [e-mail]<mailto:[e-mail]>
Cc: [e-mail]<mailto:[e-mail]>; [e-mail]<mailto:[e-mail]>; 'Hodges, Jeff' <[e-mail]<mailto:[e-mail]>>
Subject: [Jose-reg-review] Request to register JOSE algorithms for the FIDO Alliance


Hi,



The FIDO Alliance would like to register the following algorithms in the IANA "JSON Web Signature and Encryption Algorithms" registry:

1. "ED256", see https://fidoalliance.org/specs/fido-v2.0-id-20180227/fido-ecdaa-algorithm-v2.0-id-20180227.html#iana-considerations

2. "ED512", see https://fidoalliance.org/specs/fido-v2.0-id-20180227/fido-ecdaa-algorithm-v2.0-id-20180227.html#iana-considerations

3. "ED638", see https://fidoalliance.org/specs/fido-v2.0-id-20180227/fido-ecdaa-algorithm-v2.0-id-20180227.html#iana-considerations

4. "ED256-2",

    - Name "ED256-2"

    - Algorithm Description: ECDAA algorithm based on ECC_BN_DSD_P256 (https://fidoalliance.org/specs/fido-v2.0-id-20180227/fido-ecdaa-algorithm-v2.0-id-20180227.html#bib-DevScoDah2007) curve using SHA256 algorithm.

    - Algorithm Usage Locations: "alg", i.e. used with JWS.

    - JOSE Implementation Requirements: optional

    - Change Controller: FIDO Alliance, https://fidoalliance.org/contact/

    - Sections 3. FIDO ECDAA Attestation (https://fidoalliance.org/specs/fido-v2.0-id-20180227/fido-ecdaa-algorithm-v2.0-id-20180227.html#fido-ecdaa-attestation) and 4. FIDO ECDAA Object Formats and Algorithm Details (https://fidoalliance.org/specs/fido-v2.0-id-20180227/fido-ecdaa-algorithm-v2.0-id-20180227.html#fido-ecdaa-object-formats-and-algorithm-details) of [FIDOEcdaaAlgorithm].

    - Algorithm Analysis Document(s): https://fidoalliance.org/specs/fido-v2.0-id-20180227/fido-ecdaa-algorithm-v2.0-id-20180227.html#bib-FIDO-DAA-Security-Proof

("ED256-2" should have also been in the IANA Considerations section but isn't due to a clerical error.)



These names are related to cryptographic algorithms for Direct Anonymous Attestation.  The relevant details are described in https://fidoalliance.org/specs/fido-v2.0-id-20180227/fido-ecdaa-algorithm-v2.0-id-20180227.html#iana-considerations.

The algorithms were developed by Jan Camenisch of IBM (cc'ed) - a cryptographic expert.  They are in production use in FIDO deployments.



Kind regards,

     Rolf Lindemann