Re: [saag] encrypted files with UTF-8/16 passwords

Nikos Mavrogiannopoulos <n.mavrogiannopoulos@gmail.com> Mon, 03 April 2017 09:22 UTC

MIME-Version: 1.0
In-Reply-To: <EC15E156-FE69-4BAC-A127-38D7CB516F55@emc.com>
References: <CAJU7zaKRo0JkhDa7VTxd7=G6Vtuf4XiV2Kwq_-DB8KQ7R4yAxw@mail.gmail.com> <EC15E156-FE69-4BAC-A127-38D7CB516F55@emc.com>
From: Nikos Mavrogiannopoulos <n.mavrogiannopoulos@gmail.com>
Date: Mon, 03 Apr 2017 11:21:54 +0200
Message-ID: <CAJU7za++NYj6AvykAbCDtEniVxnO3CdkhuCwceNpO1505X+X2A@mail.gmail.com>
To: "Moriarty, Kathleen" <Kathleen.Moriarty@dell.com>
Cc: IETF SAAG <saag@ietf.org>, "mnystrom@microsoft.com" <mnystrom@microsoft.com>, "bkaliski@verisign.com" <bkaliski@verisign.com>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
Archived-At: <https://mailarchive.ietf.org/arch/msg/saag/STcizjP7tVYQANm-_HwWNQr7DXw>
Subject: Re: [saag] encrypted files with UTF-8/16 passwords
Precedence: list

I have put an initial draft suggesting the utilization of RFC7613 for
UTF-8 password normalization. I'd appreciate comments on the approach
and on the usage of RFC7613 in general.

https://gitlab.com/nmav/ietf-pkcs5



PS. I've started a discussion on the suitability of RFC7613 for
passwords at the precis list:
https://mailarchive.ietf.org/arch/msg/precis/WRFASSjZzb2ddqZJc5bkOlslOLE


On Fri, Mar 24, 2017 at 3:53 PM, Moriarty, Kathleen
<Kathleen.Moriarty@dell.com> wrote:
> Hi Nikos,
>
> They are just informational because they were contributed as existing standards.  Change control has been handed over to the IETF, so an update could happen to make them standards track.  Or you could start an updated draft to add what you need and we'll figure out if it has to stay informational or not.
>
> Thanks,
> Kathleen
>
> Sent from my iPhone
>
>> On Mar 24, 2017, at 4:08 AM, Nikos Mavrogiannopoulos <n.mavrogiannopoulos@gmail.com> wrote:
>>
>> Hi,
>> PKCS#8 (rfc8018) and PKCS#12 (rfc7292) can be used to encrypt keys
>> and certificates with a password. In the first case, PKCS#8 utilizes
>> PKCS#5 for converting a password to an encryption key, and PKCS#5
>> requires a password to be in UTF-8. For PKCS#12, a password is input
>> in UTF-16 format (mentioned as BMPString in the document) in some
>> preset schemes, but uses UTF-8 for newer schemes like AES via PKCS#5.
>>
>> However, UTF-8 (and UTF-16) are ambiguous. The same string may have
>> multiple representations, and for that, there are some guidelines in
>> RFC7613 to prepare a unicode string for a password, but they do not
>> update either of these documents.
>>
>> Given that these are informational RFCs, which would be the proper
>> method to propose an update on them based on these lines and requiring
>> RFC7613 processing for passwords entered in UTF-8?
>>
>> regards,
>> Nikos

[saag] encrypted files with UTF-8/16 passwords Nikos Mavrogiannopoulos
Re: [saag] encrypted files with UTF-8/16 passwords Moriarty, Kathleen
Re: [saag] encrypted files with UTF-8/16 passwords Nikos Mavrogiannopoulos
Re: [saag] encrypted files with UTF-8/16 passwords 大岩寛
Re: [saag] encrypted files with UTF-8/16 passwords David Woodhouse
Re: [saag] encrypted files with UTF-8/16 passwords Nikos Mavrogiannopoulos
Re: [saag] encrypted files with UTF-8/16 passwords Nikos Mavrogiannopoulos
Re: [saag] encrypted files with UTF-8/16 passwords David Woodhouse
Re: [saag] encrypted files with UTF-8/16 passwords Nikos Mavrogiannopoulos
Re: [saag] encrypted files with UTF-8/16 passwords David Woodhouse
Re: [saag] encrypted files with UTF-8/16 passwords Nikos Mavrogiannopoulos
Re: [saag] encrypted files with UTF-8/16 passwords Russ Housley
Re: [saag] encrypted files with UTF-8/16 passwords Nikos Mavrogiannopoulos