Re: [secdir] secdir review of draft-ietf-csi-send-name-type-registry-03

[Roque Gagliano <[e-mail]>]

Stephen/ Patrick/Sean,

Thank you for your comments. What about adding the following extra
numbers to the registry?:

  +---------+----------------------------------------------------+
     | Value   | Description                                        |
     +---------+----------------------------------------------------+
     | 0       | Reserved                                           |
     |         |                                                    |
     | 1       | DER Encoded X.501 Name (RFC 3971)                  |
     |         |                                                    |
     | 2       | FQDN (RFC 3971)                                    |
     |         |                                                    |
     | 3       | SHA-1 Subject Key Identifier (SKI) ( Section 3 )   |
     |         |                                                    |
     | 4       | SHA-224 Subject Key Identifier (SKI) ( Section 3 ) |
     |         |                                                    |
     | 5       | SHA-256 Subject Key Identifier (SKI) ( Section 3 ) |
     |         |                                                    |
     | 6       | SHA-384 Subject Key Identifier (SKI) ( Section 3 ) |
     |         |                                                    |
     | 7       | SHA-512 Subject Key Identifier (SKI) ( Section 3 ) |
     |         |                                                    |
     | 253-254 | Experimental use                                   |
     |         |                                                    |
     | 255     | Reserved                                           |
     +---------+----------------------------------------------------+

This way we stay ready if SIDR certs uses some of these hashes
functions in the future.

regards,

Roque


On Wed, May 12, 2010 at 8:00 PM, Stephen Kent <[e-mail]> wrote:
> At 6:38 PM +0200 5/8/10, Roque Gagliano wrote:
>
> Patrick,
>
> Thank you for your review.
>
> You are correct oonly 160 bits SHA-1 hash is defined in RFC 5280 and
> required in draft-ietf-sidr-res-cert
>
> Regards,
>
> Roque
>
> Roque,
> 5280 defines how to use SHA-1, but it does not require use of this specific
> hash function. 4.2.1.2 says:
>    For CA certificates, subject key identifiers SHOULD be derived from the
> public key or a method that generates unique values.  Two common methods for
> generating key identifiers from the public key are:
> ...
> Other methods of generating unique numbers are also acceptable.
> So, use of another one-way hash function, e.g., SHA-256 meets the criteria
> defined above (associated with the "SHOULD") and is consistent with the
> final comment.
> CAs need to know which function to use, but RPs just perform comparisons. We
> could modify the RPKI cert profile (if Geoff and the SIDR WG don't mind) to
> specify use of SHA-256 for generation of SKI/AKI values. I guess the real
> issue is whether commonly used software (e.g., OpenSSL) will support this.
> Steve