Re: [lamps] WG Last Call for draft-ietf-lamps-pkcs12-pbmac1-02

[Sean Turner <[e-mail]>]

And here’s the PR for the IANA Considerations section:
https://github.com/tomato42/id-pkcs12-pbmac1/pull/9

spt

> On Dec 20, 2023, at 12:40, Sean Turner <[e-mail]> wrote:
> 
> Hi! I finally got around to posting an issue & PR to add an ASN.1 module to this ID:
> https://github.com/tomato42/id-pkcs12-pbmac1/issues/6
> https://github.com/tomato42/id-pkcs12-pbmac1/pull/7
> 
> Some things to note:
> 
> I added RFC 8018 to the “updates” header because the PR includes a new ASN.1. And, I just remembered I needed to update the IANA section, will do that now.
> 
> I add a bunch of the SHA2 algorithms.
> 
> I did not add SHA3 algorithms, but could if that’s what people want to do.
> 
> spt
> 
>> On Nov 8, 2023, at 09:14, Sean Turner <[e-mail]> wrote:
>> 
>> Not really thrilled about this option.  Anyway let’s sit sometime this week and get this done ;)
>> 
>> spt
>> 
>>> On Nov 8, 2023, at 11:16, Russ Housley <[e-mail]> wrote:
>>> 
>>> I guess you could import PBKDF2-PRFs from RFC 8018, and then define:
>>> 
>>> algid-hmacWithSHA256 AlgorithmIdentifier {{PBKDF2-PRFs}} ::=
>>>    {algorithm id-hmacWithSHA256, parameters NULL : NULL}
>>> 
>>> This is not exactly aligned with the definition for AlgorithmIdentifier{} in RFCs 5911 and 5912.
>>> 
>>> Russ
>>> 
>>>> On Nov 7, 2023, at 11:23 AM, Hubert Kario <[e-mail]> wrote:
>>>> 
>>>> On Tuesday, 7 November 2023 17:13:32 CET, Sean Turner wrote:
>>>>>> On Oct 27, 2023, at 15:22, Hubert Kario <[e-mail]> wrote:
>>>>>> On Thursday, 26 October 2023 22:33:10 CEST, Russ Housley wrote:
>>>>>>> Sean:
>>>>>>> These can be imported from RFC 6268.
>>>>>> Should I do it? If yes, what's exactly expected?
>>>>>> (I do know that HMACs based on SHA-2 are already interoperable for PKCS#12,
>>>>>> both for MAC and for PBKDF2, so I don't understand what's missing...)
>>>>> 
>>>>> I’m sure the implementations probably support SHA-2 already, but we should have an ASN.1 module that includes it.  If you look in RFC 5911 s3 [0] and you look at PBKDF2-params (see page 17), what I want to make sure is that when you put a value in the prf field that "alg-hMAC-SHA256” is included in the PBKDF2-PRFs parameterized choice. Right now it’s just:
>>>>> 
>>>>> PBKDF2-PRFs ALGORITHM ::= { alg-hMAC-SHA1, … }
>>>>> 
>>>>> It’s needs to be: 
>>>>> PBKDF2-PRFs ALGORITHM ::= { alg-hMAC-SHA1, alg-hMAC-SHA256, … }
>>>>> 
>>>>> I will generate an ASN.1 module and get it checked by Russ and then submit a PR to include it in the I-D.
>>>> 
>>>> Why the definition in RFC8018 (page 35, Appendix C) is insufficient?
>>>> 
>>>> But if you think there's room for improvement, sure, please do send a PR.
>>>> 
>>>>> Cheers,
>>>>> spt
>>>>> 
>>>>> [0]  https://datatracker.ietf.org/doc/html/rfc5911#section-3
>>>>> 
>>>>>>> ...
>>>>>> -- 
>>>>>> Regards,
>>>>>> Hubert Kario
>>>>>> Principal Quality Engineer, RHEL Crypto team
>>>>>> Web: www.cz.redhat.com ...
>>>>> 
>>>>> 
>>>>> 
>>>> 
>>>> -- 
>>>> Regards,
>>>> Hubert Kario
>>>> Principal Quality Engineer, RHEL Crypto team
>>>> Web: www.cz.redhat.com
>>>> Red Hat Czech s.r.o., Purkyňova 99/71, 612 45, Brno, Czech Republic
>>>> 
>>>> _______________________________________________
>>>> Spasm mailing list
>>>> [e-mail]
>>>> https://www.ietf.org/mailman/listinfo/spasm
>>> 
>> 
>