[saag] storing validation parameters on PKCS#8 formatted private keys
Nikos Mavrogiannopoulos <n.mavrogiannopoulos@gmail.com> Mon, 07 August 2017 11:12 UTC
Return-Path: <n.mavrogiannopoulos@gmail.com>
X-Original-To: saag@ietfa.amsl.com
Delivered-To: saag@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8D51B1320B5 for <saag@ietfa.amsl.com>; Mon, 7 Aug 2017 04:12:33 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2
X-Spam-Level:
X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 82a1AEsxSLlD for <saag@ietfa.amsl.com>; Mon, 7 Aug 2017 04:12:32 -0700 (PDT)
Received: from mail-qt0-x22c.google.com (mail-qt0-x22c.google.com [IPv6:2607:f8b0:400d:c0d::22c]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 03CCF1293E1 for <saag@ietf.org>; Mon, 7 Aug 2017 04:12:32 -0700 (PDT)
Received: by mail-qt0-x22c.google.com with SMTP id s6so600412qtc.1 for <saag@ietf.org>; Mon, 07 Aug 2017 04:12:31 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:from:date:message-id:subject:to; bh=ILMOR/EZ19mg311X4D6lRd79H6FIglABLh2HsEBkhEw=; b=cd2uuZsUz3GaNyx2huYWV2p5SdXt6RXFNp6rBi6DzXad+C3xbHaMbn+xHCAgOlAE3g UzgDXvfFC+mAS4pcVz+vrFod6m5huvf7KWflqKIySBULuE3DMm564mpSt/kVjAbJV4Tf v+e2enVANe0CrCrUG3tYFFw9xeQ4hGDXckl+6e0jbX84L9/+WLonoELAEabv074EZqOR fBH+eFYqJGXsKQ0gngtcI39g3kkhhf8qgZFD7cKn4ueTaHdw6LIJgu08FXA40f5plc/A NOmyywow2U66S1gZBfznemSm3GfauzB0cv+pksZfGL0oE4AKO5E0+2NTuXxIgYKlr0zb XRJw==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:from:date:message-id:subject:to; bh=ILMOR/EZ19mg311X4D6lRd79H6FIglABLh2HsEBkhEw=; b=Tazuy+TtBUGejBhKoxHLC71/m4ohPx0ky3HbLh1LNSg1GaYyr5qckV1zlI+/3PTvaH H3KnW/zLWxTo2Ip/WYhGHaJHG1yJ7cWc8Mqh/MOPIas7O8LyDDa86T8tVqQudL1B69Av b8PYzlHKAnZ5zB1H26ravdRdRbkYWqxL3AftCQvJQrpaq4rlKBmfwckkOAJ3frazC/14 +P+cY1b/OgWvOrfEHJmzPbgOYrDMPETezeWjqSLUp1orNrVwdiOC26IqgYT1oY0aGLCx P8T/8j+TuZUYajAphd2qCXAIZRZQZ/UQqyDrlMKBM1RZfGuAbLrtQSRxxiyHuoUWDquT 3xUw==
X-Gm-Message-State: AHYfb5hMUssE4zAtkfnQPlo8tpk4lCODhqdgelIy0qH63x3/MBAXGQV4 VZ59u37+AeOb7ozWcgUV5FlKMgpLnW8lR7E=
X-Received: by 10.237.37.107 with SMTP id w40mr190061qtc.14.1502104350959; Mon, 07 Aug 2017 04:12:30 -0700 (PDT)
MIME-Version: 1.0
Received: by 10.12.209.228 with HTTP; Mon, 7 Aug 2017 04:11:50 -0700 (PDT)
From: Nikos Mavrogiannopoulos <n.mavrogiannopoulos@gmail.com>
Date: Mon, 07 Aug 2017 13:11:50 +0200
Message-ID: <CAJU7zaJpRpp-DnjrwmekOb2BEMrPOrMnQrC3AdWoD8uJ6G7Muw@mail.gmail.com>
To: IETF SAAG <saag@ietf.org>
Content-Type: text/plain; charset="UTF-8"
Archived-At: <https://mailarchive.ietf.org/arch/msg/saag/2LwduFVDFR2lxU5nGBGxsi4JL_M>
Subject: [saag] storing validation parameters on PKCS#8 formatted private keys
X-BeenThere: saag@ietf.org
X-Mailman-Version: 2.1.22
Precedence: list
List-Id: Security Area Advisory Group <saag.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/saag>, <mailto:saag-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/saag/>
List-Post: <mailto:saag@ietf.org>
List-Help: <mailto:saag-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/saag>, <mailto:saag-request@ietf.org?subject=subscribe>
X-List-Received-Date: Mon, 07 Aug 2017 11:12:34 -0000
Hi, I've needed to store parameters related to FIPS-186-4 provable key generation validation in a PKCS#8 private keys for RSA (can be used for DSA too if anyone cares). I've described the PKCS#8 extension at: http://nmav.gitlab.io/draft-mavrogiannopoulos-pkcs8-validated-parameters/ The approach followed was simple, store the validation parameters as an attribute, something that allows the keys to be backwards compatible. I'd appreciate comments on the approach. regards, Nikos
- [saag] storing validation parameters on PKCS#8 fo… Nikos Mavrogiannopoulos
- Re: [saag] storing validation parameters on PKCS#… Russ Housley
- Re: [saag] storing validation parameters on PKCS#… Nikos Mavrogiannopoulos
- Re: [saag] storing validation parameters on PKCS#… Brian Smith
- Re: [saag] storing validation parameters on PKCS#… Nikos Mavrogiannopoulos