Re: [Rats] Which Asymmetric algorithms for Charra?

["Eric Voit (evoit)" <[e-mail]>]

Hi Michael,

> From: Michael Richardson, August 11, 2020 7:27 PM
> 
> Eric Voit \(evoit\) <evoit=[e-mail]> wrote:
>     > During the charra presentation at IETF 108, we said we were going to
ask
> the
>     > following question to the list: "Should the algorithm set defined in
YANG be
>     > reduced to just those asymmetric algorithms currently exposed in the
> current
>     > TPM 1.2 and 2 specifications?"
> 
> You are asking about *asymmetric* algoritms.
> I'd like to see EdDSA in the list, and I suspect that they aren't in the
TPM spec.

The intent of charra is to be TPM specific.  So for charra it seems to make
sense to only include only asymmetric algorithms which can be served from
TPM chips.  I.e., Non TCG algorithms don't seem standardizable for this
role.

The good news is that the proposed model has been structured to allow the
addition of new algorithms by TCG or other non-standard entities who wish to
take on new algorithms.  This can be done by simply defining a new algorithm
which imports and extends the YANG identity set currently defined.
 
>     > This is reflected seen in
>     >
https://www.ietf.org/proceedings/108/slides/slides-108-rats-sessb-charra-
> upd
>     > ate-00, Slide 7.
> 
> And that slide shows them missing.
> 
>     > The proposal I would like to make is as follows:
> 
>     > *	The TCG tracked algorithms supportable by a TPM should be
the only
>     > ones included in a charra maintained list of YANG identities.
> 
> You also write:
>    2. Identities instead of strings for TCG and IETF crypto algorithm
types.
>       Strings allow lots of errors to be introduced. (Question #1)
> 
> the otherside if you don't use strings is you use an enum, which is not an
IANA
> registry.  So you need an integer with an IANA registry.

I initially had used ENUMs.  But ENUMs in YANG are hard to extend with new
values, this is why I moved to YANG identities.   Otherwise than that
identities should effectively give the same result as YANG models are
registered with IANA.
 
>     > *	The YANG model will indicate what TCG algorithms are
deprecated by
>     > the IETF.  However identities for these deprecated algorithms from
the TCG
>     > table will be assigned.  (e.g., SHA-1)
> 
> Good.
> 
>     > Are there any objections/questions/comments on this proposal?    I
have a
>     > strawman YANG file posted at:
> 
>     > https://github.com/ietf-rats-wg/basic-yang-
> module/compare/master...ericvoit:
>     > patch-4
> 
> I think you need determine if this is a *TCG TPM* yang module, or if it is
> intended to accomodate other technologies.  They might be essentially
> proprietary, but for this interface, makes them interoperate.

Exactly.  During IETF 108, the file integrated TCG and IETF values.  Since
TPMs can't really handle IETF values, I rescoped and renamed to be only TCG
algs (i.e., "ietf-tcg-algs.yang") in this proposal.

Eric

 
> --
> Michael Richardson <[e-mail]>, Sandelman Software Works  -
> = IPv6 IoT consulting =-