[Mathmesh] Query: Very best practice for RSA key generation

Phillip Hallam-Baker <phill@hallambaker.com> Thu, 17 October 2019 20:26 UTC

Return-Path: <hallam@gmail.com>
X-Original-To: mathmesh@ietfa.amsl.com
Delivered-To: mathmesh@ietfa.amsl.com
Received: from localhost (localhost []) by ietfa.amsl.com (Postfix) with ESMTP id 8E1CF120974 for <mathmesh@ietfa.amsl.com>; Thu, 17 Oct 2019 13:26:03 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.474
X-Spam-Status: No, score=-1.474 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, FREEMAIL_FORGED_FROMDOMAIN=0.172, FREEMAIL_FROM=0.001, HEADER_FROM_DIFFERENT_DOMAINS=0.25, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H3=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=no autolearn_force=no
Received: from mail.ietf.org ([]) by localhost (ietfa.amsl.com []) (amavisd-new, port 10024) with ESMTP id qZzks2mKeatd for <mathmesh@ietfa.amsl.com>; Thu, 17 Oct 2019 13:26:01 -0700 (PDT)
Received: from mail-ot1-f43.google.com (mail-ot1-f43.google.com []) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D7346120241 for <mathmesh@ietf.org>; Thu, 17 Oct 2019 13:26:01 -0700 (PDT)
Received: by mail-ot1-f43.google.com with SMTP id m19so3077752otp.1 for <mathmesh@ietf.org>; Thu, 17 Oct 2019 13:26:01 -0700 (PDT)
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to; bh=8XmKzD85WFTcSUV2tL4ZfTIL96A/9dczsTkvcrviQD4=; b=G1wpFlyIj9XvhI0GzKSPHDbn8IptKwosJdJOzgXMPPMbmtv0csDODtLlxsexgl1NQE d9bqRKvfJ8eTTAZCGXBv7WTB72Y0t/88O9w2Rrp+hCc+TN7wLFhcxESGq9iN6tukpSZ7 NT5fI+VZ7Sor0Yc6QfJBrHLwWWE6lJKdVnGMlyYiIdsNUCaj9Gn2Ad2v9+qsT7KSALCT elSCZK/eTtApKPBiqv7SjkOoAAxv6RBjEOXfMpHvpC9PQKtB4BmHJrHM7+DzUuElLHNn tzz971HvS+UGolEQGqei4zZOEiRmIGYZZuDYDaUPvOSm3e6o+vej2l/NUWwN3+emxV8d uSmw==
X-Gm-Message-State: APjAAAVHtMNNnmzQJ/QnOEiraI4GqFqeGXINItaLVPWDef4V7UgC7ocP RHu5Xp6HTw2SJ7mY2fVkgBk4NXXDyNpiMwitKaILyByY
X-Google-Smtp-Source: APXvYqxMbT89A9SgsY9TfdnuzqKx+gZXzO8e8fKuTmWrU3nYFmQJM0iE7H5hyDlKc0lXY/yelfwMH03lKqicosJbhqY=
X-Received: by 2002:a9d:3a3:: with SMTP id f32mr4916153otf.231.1571343961172; Thu, 17 Oct 2019 13:26:01 -0700 (PDT)
MIME-Version: 1.0
References: <CAMm+Lwixgjj-B0qG=0=Z59egb6fJ2BixW53gfvaPUcZ7r9Ys0w@mail.gmail.com>
In-Reply-To: <CAMm+Lwixgjj-B0qG=0=Z59egb6fJ2BixW53gfvaPUcZ7r9Ys0w@mail.gmail.com>
From: Phillip Hallam-Baker <phill@hallambaker.com>
Date: Thu, 17 Oct 2019 16:25:56 -0400
Message-ID: <CAMm+LwhLb7mnQmjAOxMMsPrzAZb==ix9Erfse5UDSoj0uB0iHQ@mail.gmail.com>
To: cfrg@irtf.org, mathmesh@ietf.org
Content-Type: multipart/alternative; boundary="000000000000a031d305952106af"
Archived-At: <https://mailarchive.ietf.org/arch/msg/mathmesh/UpE46bL_4jSmG8yChw_kECvpN9Q>
Subject: [Mathmesh] Query: Very best practice for RSA key generation
X-BeenThere: mathmesh@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: <mathmesh.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/mathmesh>, <mailto:mathmesh-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/mathmesh/>
List-Post: <mailto:mathmesh@ietf.org>
List-Help: <mailto:mathmesh-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/mathmesh>, <mailto:mathmesh-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 17 Oct 2019 20:26:04 -0000

[CC'd to CFRG as this is a crypto question, MATHMESH as the target group,
OpenPGP as a group that recently asked for the same capability. Also to the
cryptography list for additional eyes. Looking to add this to the UDF draft

A question has come up for generating key pairs from a specified random
seed. I am just looking to add this to UDF and would like advice as to what
the very best practices are for RSA keygen.

The use case here is that the user wants to be able to be very very sure
the key was correctly generated and that they can recover it. So lets say I
want to configure OpenPGP with the same keypair on three different machines
without the full Mesh PKI.

The basic idea is that a user has a key which expressed in Base32 looks
like this:


The first three bytes are
C8     Type code for key generation with 16 bit key type]
00,00 RSA 2048 bit key pair

The remaining characters are to provide randomness for the key
generation function. A minimum of 112 bits (work factor of RSA 2048) are
required. So 112+24 = 136 bits

To generate keys, HMAC-KDF is used

p0 = KDF ("ZAAA-UJUY-H7TF-SFLK-CWAW-TKC4-O5HQ".FromBase32(), "P")
q0 = KDF ("ZAAA-UJUY-H7TF-SFLK-CWAW-TKC4-O5HQ".FromBase32(), "Q")

p = next_prime (p0)
q = next_prime (q0)

So that is the RSA part.

I don't plan to do DH. For ECDH, I suggest the NIST and CFRG curves only.

OK so some interesting variations. Lets say I don't trust the random number
generator on any one machine. So lets use Shamir Secret sharing on three
different machines for a 140 bit output:

f(2) = SAYX-4HWP-3753-L4P3-N4S6-C2G4-QVPA-A

We can now combine the shares on the target machine to (re)generate the
keypair. We can also give ourselves a couple of additional shares as well:

f(5) = SA2C-H3IC-2ORN-NOK2-DM3X-OX37-FJ6W-Q