Re: [lamps] [CMP Updates] Hash algorithm to us for calculating certHash

I prefer to use SHA-512 for Ed25519 and SHAKE256(x, 64) for Ed448, as in
RFC8419:

2.3 <https://datatracker.ietf.org/doc/html/rfc8419#section-2.3>.
Message Digest Algorithm Identifiers

   When the signer includes signed attributes, a message digest
   algorithm is used to compute the message digest on the eContent
   value.  When signing with Ed25519, the message digest algorithm MUST
   be SHA-512 [FIPS180
<https://datatracker.ietf.org/doc/html/rfc8419#ref-FIPS180>].
Additional information on SHA-512 is available
   in [RFC6234 <https://datatracker.ietf.org/doc/html/rfc6234>].  When
signing with Ed448, the message digest algorithm
   MUST be SHAKE256 [FIPS202
<https://datatracker.ietf.org/doc/html/rfc8419#ref-FIPS202>] with a
512-bit output value.

On Tue, Jun 8, 2021 at 5:20 PM Brockhaus, Hendrik <
hendrik.brockhaus@siemens.com> wrote:

> In OpenSSL recently a problem has been identified on how to derive a hash
> algorithm from signatureAlgorithm OID when using EdDSA, see
> https://github.com/openssl/openssl/issues/15477
>
> In CMP this implicitly defined hash algorithms is used to calculate the
> certHash in a certConf messages. This would fail when using EdDSA.
> The CertStatus structure including certHash is defined as follows:
>      CertStatus ::= SEQUENCE {
>         certHash    OCTET STRING,
>         -- the hash of the certificate, using the same hash algorithm
>         -- as is used to create and verify the certificate signature
>         certReqId   INTEGER,
>         -- to match this confirmation with the corresponding req/rep
>         statusInfo  PKIStatusInfo OPTIONAL
>      }
>
> Therefore, the hash algorithms to be used for computing the certHash must
> be determined in some other way.
> I currently see the following options:
> (1) Specify usage of SHA-1 for calculating certHash, similar to the
> definition of the keyIdentifier in RFC 5280 Section 4.2.1.2.
>   This is the cheapest solution, but we explicitly removed SHA-1 from CMP
> Algorithms, see mail thread "Re: CMP Algorithms I-D".
> (2) Specify a hash algorithm on a per signature algorithm basis.
>    This is also quite simple to implement, but costly to maintain for
> upcoming algorithms.
> (3) Extend the ASN.1 syntax of CertStatus to allow to specify an optional
> hashAlg OID for those cases where the hash algorithm cannot be determined
> automatically.
>    This is probably the cleanest solution, but involves a change to the
> ASN.1 syntax.
>
> Does anyone sees other, better solutions?
> What solution is preferred by the WG?
>
> - Hendrik
>
> _______________________________________________
> Spasm mailing list
> Spasm@ietf.org
> https://www.ietf.org/mailman/listinfo/spasm
>

-- 
Lijun Liao