Re: [pkix] Question about Curve P-192

Actually see RFC5480.  It describes a set of suggested pairings of
signature strengths and hashes and includes recommendations for P-192.

Re Russ’s comment, the ECDSAWithShaxxx identifiers can be used with any
curve, (but follow the 5480 and other similar document pairing
recommendations)   so it’s not exactly correct that there are no algorithm
identifiers.

Lastly, AFAICT NIST didn’t originally define the P192 curve - it just
incorporated a previously defined curve in a set of acceptable parameters
when it was NISTifying EC cryptography.

Mike

On Thu, May 10, 2018 at 17:47 Denis <denis.ietf@free.fr> wrote:

> Hi Ernst, Russ and Dan,
>
> Thank your for your replies. This is what I feared : there is no
> cryptographic suite defined for P-192.
> Quite strange that NIST defined the algorithm and didn't defined a hash
> function to go with it.
>
> Key sizes need to be appreciated relative to the environment where they
> are used.
>
> P-192 would be used in a constrained environment where the size of the
> digital signature matters (i.e. the smaller, the better).
>
> The verification of the digital signature would be real time. The private
> key should resist one year, because it would be changed every year.
>
> P-192 seems to be a good trade-off between the security level and the size
> of the digital signature.
>
> A SHA-192 function has been defined in a paper available at:
> http://www.ijctee.org/files/VOLUME2ISSUE3/IJCTEE_0612_24.pdf.
> The title of this paper is : Performance Analysis of SHA Algorithms (SHA-1
> and SHA-192): A Review
> However, I don't believe that any crypto-library supports it.
>
> So Ernst's method would certainly be one way to do it, but why not take
> the 192 low bits ?
>
> The last question would be for Ernst who wrote:
>
> The corresponding signature suite can be defined with ISO 14888-3, which
> allows the specification of the algo
>
> (e.g. EC-DSA, EC-KCDSA or whatsoever), the curve and the hash function.
>
> What would the OID or the URI for this suite, if we take the 192 left bits
> ? Same question if we take the 192 low bits ?
>
>
> Denis
>
> Hi Denis,
>
>
>
> Please, do not use P-192, unless there are some severe constraints.
>
>
>
> Even if you credit EC with a very generous 16 extra bits in security
> (compared to hashes & ciphers), P-192 would only reach 96+16=112-bit
> security, which does not meet the current best practice of 128 bit security.
>
>
>
> History as I understand it: NIST P-192 was meant for the 80-bit level
> (though it looks like 96-bit). This low security level has been widely
> deprecated since 2010, at least informally - to what extent it is formally
> deprecated, I don’t recall off-hand. I recall added text to ANSI X9.62/63
> deprecating this security level.
>
> Anyway, originally, the idea was to use P-192 with SHA-1, P-224 with
> SHA-224, etc.
>
> I think that there were also OIDs for P-192, e.g. secp192k1, and OIDs for
> ECDSA-with-SHA1, which could be combined in some ways.  I do not recall how
> far these OIDs made into IETF, i.e. as algorithm identifiers.
>
> Using 160-bit hash in ECDSA with P-192 renders the EU-CMA security to 80
> bits, which is waste considering that P-192 potentially provides 96-bit
> security.  As noted in the thread below, the standards have options to
> truncate a longer hash, which should correct this.
>
>
>
> Arguably, the security of P-192 has fared far better than SHA-1 in some
> ways, yet SHA-1 is probably much more widely used than P-192, though
> admittedly hashes are considered a general purpose tool.
>
>
>
> Best regards,
>
> Dan
>
>
>
>
>
> *From:* pkix [mailto:pkix-bounces@ietf.org <pkix-bounces@ietf.org>] *On
> Behalf Of *Russ Housley
> *Sent:* Thursday, May 10, 2018 1:30 PM
> *To:* Ernst G Giessmann <giessman@informatik.hu-berlin.de>
> <giessman@informatik.hu-berlin.de>
> *Cc:* IETF PKIX <pkix@ietf.org> <pkix@ietf.org>
> *Subject:* Re: [pkix] Question about Curve P-192
>
>
>
> Ernst:
>
>
>
> Of course, this technique works.  That said, I am not aware of any
> algorithm identifiers that make use of the P-192 curve for digital
> signature or key agreement.
>
>
>
> Russ
>
>
>
>
>
> On May 10, 2018, at 1:24 PM, Ernst G Giessmann <
> giessman@informatik.hu-berlin.de> wrote:
>
>
>
> Yes, there is a standardized way:
> Pick up a corresponding hash function, in case of P-192 it should be
> SHA-224 and take the 192 left most bits of the hash value as the input to
> the EC sign primitive.
> The correspondig signature suite can be defined with ISO 14888-3, which
> allows the specification of the algo (e.g. EC-DSA, EC-KCDSA or whatsoever),
> the curve and the hash function.
> Kind regards,
> /Ernst.
>
> Am 2018-05-10 um 19:07 schrieb Denis:
>
> Hello everybody,
>
> Curve P-192 is specified in FIPS PUB 186-4 (Digital Signature Standard
> (DSS)).
>
> There is no "SHA-192" hash function defined in FIPS PUB 180-4 (Secure Hash
> Standard (SHS)).
>
> Is there any standardized way to use a hash function with Curve P-192 ?
>
> Is there any RFC or any another document that specifies a cryptographic
> suite for Curve P-192 ?
>
> Denis
>
>
>
>
>
>
>
> _______________________________________________
>
> pkix mailing list
>
> pkix@ietf.org
>
> https://www.ietf.org/mailman/listinfo/pkix
>
>
>
> _______________________________________________
> pkix mailing list
> pkix@ietf.org
> https://www.ietf.org/mailman/listinfo/pkix
>
>
>
>
> _______________________________________________
> pkix mailing listpkix@ietf.orghttps://www.ietf.org/mailman/listinfo/pkix
>
>
> _______________________________________________
> pkix mailing list
> pkix@ietf.org
> https://www.ietf.org/mailman/listinfo/pkix
>