Re: [secdir] a few new algs and a bunch of deprecation

[Yoav Nir <[e-mail]>]

> On 3 Nov 2015, at 5:56 PM, Simon Josefsson <[e-mail]> wrote:
> 
> I'm following Curve25519/Ed25519 use in IETF protocols and is
> interested in helping that effort.  It seems the intersection between
> this putative WG and existing WGs needs to be carefully explained
> though, it isn't clear to me how it could be done.  Isn't deprecating
> crypto parts of a protocol up to each protocol community to think
> about?  We've seen with TLS, OpenPGP, Secure Shell and PKIX that
> adding Curve25519/Ed25519 is highly protocol specific and requires
> domain knowledge.

My take on this is the exact opposite. We’ve added ChaCha20/Poly1305 to SSH and TLS and IPsec. Same algorithm in all three (yes, I know SSH uses the old construction). 

We’re adding Curve25519/Ed25519 to SSH and TLS and IKE and PGP and PKIX. Same algorithm for all of them.

Is it safe to use SHA-1 in signatures? Regardless of what you think the answer is, it is the same in TLS and PGP and IKE and SSH and PKIX.

I think the best thing with such algorithms is to have guidance documents from either CFRG or Security AD-sponsored, and then have the separate protocol documents be little more than code point allocations.

Yoav