Re: [saag] draft-iab-crypto-alg-agility-00

[Ben Laurie <[e-mail]>]

On 3 April 2014 18:51, Russ Housley <[e-mail]> wrote:
>
> I gave a presentation at the SAAG session in London about this document.  Stephen said that the discussion would continue on this list.  I'm posting this message to get that discussion going.


Thinking about this in the context of Certificate Transparency, it
seems there are a couple of problems with the I-D.

"IETF protocols that make use of cryptographic algorithms MUST carry
one or more algorithm identifier."

CT (at least currently) does not carry the algorithm identifier in
band, it is metadata that is known about each log. Allowing logs to
choose algorithms on-the-fly probably results in reduced security.

I guess this is because the threat model is unusual: the bad guy is
running the log. Normally one assumes that the bad guy is not one of
the endpoints.

A corollary of this is that

" If a protocol does not carry an algorithm identifier, then the
   protocol version number or some other major change is needed to
   transition from one algorithm to another.  The inclusion of an
   algorithm identifier is a minimal step toward cryptographic algorithm
   agility."

would appear to be incorrect.

Finally, I'm not really sure what s3.3 is getting at. It makes some
statements about some protocols without drawing any conclusions that I
can discern.