Re: [pkix] Question about Curve P-192

[Denis <[e-mail]>]

Hi Ernst, Russ and Dan,

Thank your for your replies. This is what I feared : there is no 
cryptographic suite defined for P-192.
Quite strange that NIST defined the algorithm and didn't defined a hash 
function to go with it.

Key sizes need to be appreciated relative to the environment where they 
are used.

P-192 would be used in a constrained environment where the size of the 
digital signature matters (i.e. the smaller, the better).

The verification of the digital signature would be real time. The 
private key should resist one year, because it would be changed every year.

P-192 seems to be a good trade-off between the security level and the 
size of the digital signature.

A SHA-192 function has been defined in a paper available at: 
http://www.ijctee.org/files/VOLUME2ISSUE3/IJCTEE_0612_24.pdf.
The title of this paper is : Performance Analysis of SHA Algorithms 
(SHA-1 and SHA-192): A Review
However, I don't believe that any crypto-library supports it.

So Ernst's method would certainly be one way to do it, but why not take 
the 192 low bits ?

The last question would be for Ernst who wrote:

    The corresponding signature suite can be defined with ISO 14888-3,
    which allows the specification of the algo
    (e.g. EC-DSA, EC-KCDSA or whatsoever), the curve and the hash function.

What would the OID or the URI for this suite, if we take the 192 left 
bits ? Same question if we take the 192 low bits ?

Denis

> Hi Denis,
>
> Please, do not use P-192, unless there are some severe constraints.
>
> Even if you credit EC with a very generous 16 extra bits in security 
> (compared to hashes & ciphers), P-192 would only reach 96+16=112-bit 
> security, which does not meet the current best practice of 128 bit 
> security.
>
> History as I understand it: NIST P-192 was meant for the 80-bit level 
> (though it looks like 96-bit). This low security level has been widely 
> deprecated since 2010, at least informally - to what extent it is 
> formally deprecated, I don’t recall off-hand. I recall added text to 
> ANSI X9.62/63 deprecating this security level.
>
> Anyway, originally, the idea was to use P-192 with SHA-1, P-224 with 
> SHA-224, etc.
>
> I think that there were also OIDs for P-192, e.g. secp192k1, and OIDs 
> for ECDSA-with-SHA1, which could be combined in some ways.  I do not 
> recall how far these OIDs made into IETF, i.e. as algorithm identifiers.
>
> Using 160-bit hash in ECDSA with P-192 renders the EU-CMA security to 
> 80 bits, which is waste considering that P-192 potentially provides 
> 96-bit security. As noted in the thread below, the standards have 
> options to truncate a longer hash, which should correct this.
>
> Arguably, the security of P-192 has fared far better than SHA-1 in 
> some ways, yet SHA-1 is probably much more widely used than P-192, 
> though admittedly hashes are considered a general purpose tool.
>
> Best regards,
>
> Dan
>
> *From:* pkix [mailto:[e-mail]] *On Behalf Of *Russ Housley
> *Sent:* Thursday, May 10, 2018 1:30 PM
> *To:* Ernst G Giessmann <[e-mail]>
> *Cc:* IETF PKIX <[e-mail]>
> *Subject:* Re: [pkix] Question about Curve P-192
>
> Ernst:
>
> Of course, this technique works.  That said, I am not aware of any 
> algorithm identifiers that make use of the P-192 curve for digital 
> signature or key agreement.
>
> Russ
>
>     On May 10, 2018, at 1:24 PM, Ernst G Giessmann
>     <[e-mail]
>     <mailto:[e-mail]>> wrote:
>
>     Yes, there is a standardized way:
>     Pick up a corresponding hash function, in case of P-192 it should
>     be SHA-224 and take the 192 left most bits of the hash value as
>     the input to the EC sign primitive.
>     The correspondig signature suite can be defined with ISO 14888-3,
>     which allows the specification of the algo (e.g. EC-DSA, EC-KCDSA
>     or whatsoever), the curve and the hash function.
>     Kind regards,
>     /Ernst.
>
>     Am 2018-05-10 um 19:07 schrieb Denis:
>
>         Hello everybody,
>
>         Curve P-192 is specified in FIPS PUB 186-4 (Digital Signature
>         Standard (DSS)).
>
>         There is no "SHA-192" hash function defined in FIPS PUB 180-4
>         (Secure Hash Standard (SHS)).
>
>         Is there any standardized way to use a hash function with
>         Curve P-192 ?
>
>         Is there any RFC or any another document that specifies a
>         cryptographic suite for Curve P-192 ?
>
>         Denis
>
>
>
>
>
>         _______________________________________________
>
>         pkix mailing list
>
>         [e-mail] <mailto:[e-mail]>
>
>         https://www.ietf.org/mailman/listinfo/pkix
>
>     _______________________________________________
>     pkix mailing list
>     [e-mail] <mailto:[e-mail]>
>     https://www.ietf.org/mailman/listinfo/pkix
>
>
>
> _______________________________________________
> pkix mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/pkix