[lamps] Key usage bits for end-entity certs in draft-ietf-lamps-x509-slhdsa
Corey Bonnell <Corey.Bonnell@digicert.com> Tue, 07 January 2025 15:35 UTC
Return-Path: <Corey.Bonnell@digicert.com>
X-Original-To: spasm@ietfa.amsl.com
Delivered-To: spasm@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8A899C14F6B7 for <spasm@ietfa.amsl.com>; Tue, 7 Jan 2025 07:35:45 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.251
X-Spam-Level:
X-Spam-Status: No, score=-2.251 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.148, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_MESSAGE=0.001, RCVD_IN_MSPIKE_H2=-0.001, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.001, RCVD_IN_VALIDITY_SAFE_BLOCKED=0.001, RCVD_IN_ZEN_BLOCKED_OPENDNS=0.001, SPF_NONE=0.001, T_SCC_BODY_TEXT_LINE=-0.01, URIBL_BLOCKED=0.001, URIBL_DBL_BLOCKED_OPENDNS=0.001, URIBL_ZEN_BLOCKED_OPENDNS=0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=digicert.com
Received: from mail.ietf.org ([50.223.129.194]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 9nAO90bLKOfc for <spasm@ietfa.amsl.com>; Tue, 7 Jan 2025 07:35:40 -0800 (PST)
Received: from NAM02-DM3-obe.outbound.protection.outlook.com (mail-dm3nam02on2100.outbound.protection.outlook.com [40.107.95.100]) (using TLSv1.2 with cipher ECDHE-ECDSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A63BFC14F689 for <spasm@ietf.org>; Tue, 7 Jan 2025 07:35:40 -0800 (PST)
ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=H6ydpeqlXET3hm4HoNx7EUMWpyTTUKQhAIVXQWEeSGqknYmHJ5da7QkdnEzKSegORyxV3IVEjAuSwJa5XnaY1T811sPWquYE96yNRAhukrKgNx2E0CuL/vy4MEBaIUQozY9d4CeQMKiShfhsmxDqQrYjTPOoiSWEP4cDyZfPfNQislaY2MayVrjPTtCSsbMHKHri4NExebehCHnXTFp0zNvX8V4R4mK87DiOUvkWgUri6ShFF4TjbolBDEGImCjNfx2gaM5ZfmTzZvu7AsqiNNQpMBhYmjqROmGZZoCcTCxICI91T9IwRT3vMFzGjpKD7uPsmjt9Wh/oc/jcPLTT9Q==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=c1yrrum46Tj+2XIiJ9HwJwfmSxazlruwfoLLOHCalKw=; b=CGO9OJEW3zAT5GVJYxHV1UuDev6cUxQL9wL2XJJvZBmyxco01QExNryyHgNyzHnUKF8PDaq+u2joglfVu+2COMKTel9xgGbldbdAk9wX4dc+hfTwLQXqE4viBzpLXvzj48pzTrRtK8TnDa80YLoPm8/lKAji0JdkGbOrTyrrDAJsh8SpUZuyw7GaUh3pglpmlPDf4RprHcLdyovBIwWG8JkhvJyGhpBFm/WoX3nVBhyisevNTeO5aoH8zoTT+alccDnsZBrFccl1EFE0dCrKuntDdIvP8nmQbmsV+wEtcY83O6o3lORlzDpWCVg4MSytfVQLC1ocx1V2IFJ/sJGSug==
ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=digicert.com; dmarc=pass action=none header.from=digicert.com; dkim=pass header.d=digicert.com; arc=none
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=digicert.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=c1yrrum46Tj+2XIiJ9HwJwfmSxazlruwfoLLOHCalKw=; b=EYjiKDC4f+KszzfgwTwLu1faMd7ZPzKzyq0HcvkZ5t8cURMoktdAvYzSa3JgWDF9x2z78Wotk5DguFmKnp62DpzWO4F9sp1UULYd6Dz86xAgPe9jO4A/pLR7fmumzaL0562tIxjNxEZeYfJr6S3q68KPs/bXVakBzwzVsclhHiYfjYe+CaDsbrVakuS3jhUL7rbXdNr29yKASKp6xZSt2nwdTtLxuyfO+d4qoiFE6uQp39ESvAwJu9/RxX+3waJSqjIgmeFXogDAdEu5Fpb96Fi8NJ7AzN6SpNzcmE63owgABcKj1x1KRRstGCg6lQp9IdIGjbF1tEkIaZynLsWP/w==
Received: from DS0PR14MB6216.namprd14.prod.outlook.com (2603:10b6:8:11c::19) by IA1PR14MB6343.namprd14.prod.outlook.com (2603:10b6:208:421::15) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.8335.10; Tue, 7 Jan 2025 15:35:36 +0000
Received: from DS0PR14MB6216.namprd14.prod.outlook.com ([fe80::32a:f2b7:2b3e:2e10]) by DS0PR14MB6216.namprd14.prod.outlook.com ([fe80::32a:f2b7:2b3e:2e10%6]) with mapi id 15.20.8314.015; Tue, 7 Jan 2025 15:35:35 +0000
From: Corey Bonnell <Corey.Bonnell@digicert.com>
To: LAMPS WG <spasm@ietf.org>
Thread-Topic: Key usage bits for end-entity certs in draft-ietf-lamps-x509-slhdsa
Thread-Index: AdthGXKcOgBqWbK7RQWbbVjaWfWcdA==
Date: Tue, 07 Jan 2025 15:35:35 +0000
Message-ID: <DS0PR14MB62165BC0294C93958CD1DB8192112@DS0PR14MB6216.namprd14.prod.outlook.com>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach: yes
X-MS-TNEF-Correlator:
authentication-results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=digicert.com;
x-ms-publictraffictype: Email
x-ms-traffictypediagnostic: DS0PR14MB6216:EE_|IA1PR14MB6343:EE_
x-ms-office365-filtering-correlation-id: 3feeb531-888a-4a24-98bd-08dd2f30ee36
x-ms-exchange-senderadcheck: 1
x-ms-exchange-antispam-relay: 0
x-microsoft-antispam: BCL:0;ARA:13230040|376014|366016|1800799024|8096899003|38070700018;
x-microsoft-antispam-message-info: zBHLpVcVdaKcKMImTayQoyIgAVJpu+c6J3KnKSyduIlJ7DERuBFcbb3z7a99FzpKmWeyiceOljbD41oDhuXs5gF/IUThXAnP23JAhKTjOAy1FnLVLMzsRe7wu50UR/NtVWJL4d9Vy9fQSQIQaQE1tADyQrpZ9kwMpiDZaBeLeX4w1w5un6AwsU3Qr+Pi1+Do8C6mrazf2g8kxXgL67g/37/QFdJaeV70lxZp14mCb67H7LKzn3RD7Mx6K0AbuYbZ2ri8LroWigQSpFQ9052qlS8AgW+QHVErmpvLgUWJBvrMVIprxYZzminhtj0wPmX7/QKpRMaqnl8pyil64aHjXnK6tcliCDQdl+fi5beICo6EbmdrdUOHUFOk/Pt2V47BJM2WJZ2DxzaK0M9QpLjGdkPZxdnh66BDBrYTxVuvgfyuyCWXixiBMJvJtFFKJxshrdWOtnhqIaStE07e31LcIJSpePyI4WcySTYLccjoJoaDTPFdmqcGvTox34Db43eAMY1MMIkphdNK7DBCF4pD1ABdBxuAVoJ8GWKz3xf74I1SdTQWKpfFnQs0zhrkq7LkPtc19n4ubkYCUA3zwAgAWNmUsTzUl5U05yOWileVS9X0E15GmpQDrUfbgQuNbP/qyTQ2cJkxoBU7dUdghP6MzwDSRxCU4GKaSKvxPWFmSzayoflVrvbiqQVa9zjtkGzL58pLdeamWUJGrGfZOvG9MIw3Veygo0euf8vSuz5BmfKtyK1OQAJ/3PqAgGtVsa3zMQgdxsRO9Uqi3MxgNL2l71B/KJhNX/kT17bXwa2w/4liH3vNsnm+dKz4PM1bbJYzjS1RNq+bInvY6+hGeYcZEUr/Imv/ucffvijNa6Ac2NO/XVbzS1k2sd8zBKsrU0kg72G7AHyHYx/9mBW0OxIOGDALFoUj20dmVm/4s8eneyLNaTsR/p+aI/3dg7gGieYo0zclQlZAv2yLK2pe6iqMeIOpJ41MoGxhjrhDomTjjVdXgA/wH7/9iH2kj9IkSrOUgA0SzRT4kiE1mQUSwtPEsVxavxvuaEEoUkGEs7P5Q2i+oAYTeurEI09Lfc5FlnkLpN9CERtPoAK0h4s2Ui+uQgO+S1j7vpnKOLIySR+OMb7+SuSkwAi+9D42/AYdrzJStvC5R+4J/2TvXfWCaq8k94XxZNw9mFaspei2h/3c+HgEMLxxmlOb4lTZAHTecc+TpTNjCqcwOt63hCzZGYGdX3GJzbKeuTmW2XrtEYiBt7Hy8CEJg2ZvYclhHqvmDwvxTeuQQ1M+fPzpgUuR+8e2Clryp45KFlOH5DASM90oSXQ2bvatG8xRytNH0eKPnvxKOvLymZVQe0QhfUP4ojn/3n6uomYpF2QGjQ0hFgDC6MZakzH7YiyxaShY6rg3MS0OF1+L2+gyZe7+5XfNF8f0SoST2u0WNzTDfva6i9QUMIXJeANlLuj7SR9tRAfaubtX
x-forefront-antispam-report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:DS0PR14MB6216.namprd14.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230040)(376014)(366016)(1800799024)(8096899003)(38070700018);DIR:OUT;SFP:1102;
x-ms-exchange-antispam-messagedata-chunkcount: 1
x-ms-exchange-antispam-messagedata-0: PH2YvwUCdxeKH8KyAUS6ntrbbA1tbjVpiM1D3ltZM0tx3iWVA7sj9DgCMSD/+UnZ0fjXcHSvF6arCZCqtC++rdm/3oTXNlANs+SeMO6wQN/lOff7quXmufDcUcHfqOo5lWXScY2/mndAfZpOIVLvui23ATTg7uXWsOvJ/ZNU6V3oLa/Bd/ugoUuef4IBh677v+NuvMHKN9WfltSwGGVuXC95pMOL5wZwollAhD8oeWl4Krm+9ReBtxl3mx6oKGEnhu+7Jcv5Lgo0rxJy6OL8sFWKqt2cr6dnUfMDwXaZkDVRb+zT5mmdZTGn0N4oGlLlyXpzr9ZWsKNmglQpr6oyq+Bfb+qYonTjx192OO5xRQmFh99p9PuFa6bHfNBSTlHQnFzJziD8B4vo0+22oN94DMjH0DoMuNu9h1CAPkQ9Lv863E67rH9V+6mEHwBWjPc4hZOZzI6WyNOJL2iBicAtiRasi9U9s/jDCDWn7QODlc1KMKOR/sRvCyWZWkkfe0uO6Wmu1bJmVRocXj+ERcVZ+n8oMSCsk6eSggXsqUsCuSGA2IveqU60JPcQut7JlZO3E0UikDf47U8llvcooR9yZtVx60bnC0BNNK340P/1xrxzzuLO6dJGYdOvWpbgIXqMmd5SjrD2l/kY8ElyQAjHN8FYPNul05avE1LQcn11bfVCim/thVvjFcQqbFevWUdOS4dtx3U4MOm+sSl6wPsDvl4wROZb9TmqJuw8g3OpHwzVEvJ2q+W3u45RBwti7f/GjwwBLKCTaAszh2E9RmIMZKBzwxN+soZnvP+4qqzg2FbIKSftzcTHaN//ZaeuSl+H/CsPjPmqQwinkAccsTQKP61MocKqQt7M7nS4wsRmXr350eApmiZGm9ynOy3uGH5apSsQaSiBKyQVELuF0mkRm6YKT9e4RPGiTSGxpiAxv6Ixhhsqb4+F1vrXjwB97/qRpO4UVmnZuoIJ+JnlNY79iSaxhprZnvSs9PBwbrYcXih/FKmgdo07L40DQFhVhKMtER5FOTAApDQYNi2tKm+P+7ZvGqmh6gsgCEu+X6LKWxFQPxGhAKSULeZv2e61xOm4gVmpRl3Ggqp0i1reCbrqycGk/mc6vUw+nbsJKWgcsLdym/wu+aJUUadQzev/WEsj3eqHnMRTfYC7TvsUFSy/qBg4cx2FyJVntAijX4UxqCt+9J0Hq29cSzjtamR+eaExaBQSeMZi+o9fgn/7KpSvGy5S+F380L1UimNn6+qsi7Sa2AeukjiH8n+tPHOl21//uHgjRC7CmpWoPj+j7D2A5T1FZYVkLm7rLG81do4/pAmdeuyC573lUJP39j4hhpTnJYfWL4k5LyyTWJ7CeMEquEhM5/pMBmaf/877Nrmd9SwDegobjaAHgQxPHg6fITQnOD/r6q0FdhGu3MvlG1ePSlpDeWW69JhLSa2JGRI5Gv559TE//5nlFXr5U4tC03SL1L5DBWUbldL2uf+J8lUWlBKNLQzQtRdb7LNI/aAdAlmVGY8P2IPzAmadz/3UpZnSzN16zZKM5z1Ofgwmx74EC/rq+3viH2lB8C48sH61OjsfbcytKJJX8Vr53T9OKZeD
Content-Type: multipart/signed; protocol="application/x-pkcs7-signature"; micalg="SHA1"; boundary="----=_NextPart_000_00E8_01DB60EF.C7EBA100"
MIME-Version: 1.0
X-OriginatorOrg: digicert.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-AuthSource: DS0PR14MB6216.namprd14.prod.outlook.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 3feeb531-888a-4a24-98bd-08dd2f30ee36
X-MS-Exchange-CrossTenant-originalarrivaltime: 07 Jan 2025 15:35:35.7664 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: cf813fa1-bde5-4e75-9479-f6aaa8b1f284
X-MS-Exchange-CrossTenant-mailboxtype: HOSTED
X-MS-Exchange-CrossTenant-userprincipalname: gr6dlJclBLmXAhzQw05VBUOI+JOYtw7WBuaQBS4zjqWvvZG6or91aIjEAVXp0CxuD5cCiBYmb3o0Xu9tZL1xjY9T3dpkNlHvJlgEahmgpBU=
X-MS-Exchange-Transport-CrossTenantHeadersStamped: IA1PR14MB6343
Message-ID-Hash: SVAFL5LLEEOMYB2BMY4OJX45JWMIKF3E
X-Message-ID-Hash: SVAFL5LLEEOMYB2BMY4OJX45JWMIKF3E
X-MailFrom: Corey.Bonnell@digicert.com
X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; header-match-spasm.ietf.org-0; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header
X-Mailman-Version: 3.3.9rc6
Precedence: list
Subject: [lamps] Key usage bits for end-entity certs in draft-ietf-lamps-x509-slhdsa
List-Id: This is the mail list for the LAMPS Working Group <spasm.ietf.org>
Archived-At: <https://mailarchive.ietf.org/arch/msg/spasm/OAOglQOchNgQi-jT24JCNOX9_PE>
List-Archive: <https://mailarchive.ietf.org/arch/browse/spasm>
List-Help: <mailto:spasm-request@ietf.org?subject=help>
List-Owner: <mailto:spasm-owner@ietf.org>
List-Post: <mailto:spasm@ietf.org>
List-Subscribe: <mailto:spasm-join@ietf.org>
List-Unsubscribe: <mailto:spasm-leave@ietf.org>
Hello, On the monthly PQC Hackathon call this morning, there was a discussion on KU bits in the draft-ietf-lamps-x509-slhdsa draft [1] for the pre-hashed variants. Currently, the draft allows for the inclusion of the pre-hashed variants in the SPKI but only allows the inclusion of the digitalSignature and nonrepudiation KU bits when a pre-hashed OID is specified in the SPKI. Notably, cRLSign is disallowed. This differs from draft-ietf-lamps-x509-shbs [2], where cRLSign is allowed in end-entity certificates. Is there is a reason for this difference, or should draft-ietf-lamps-x509-slhdsa be aligned to allow cRLSign in end-entity certs with pre-hashed variant SPKIs? My personal preference is to allow it since the pure variants of SLH-DSA are not feasible to use for the signing of CRLs of any appreciable size. Also, there are no fancy tricks for SLH-DSA like there is with External-mu for ML-DSA that makes signing with the pure variants feasible for larger messages. Thanks, Corey [1] https://www.ietf.org/archive/id/draft-ietf-lamps-x509-slhdsa-03.html#name-ke y-usage-bits [2] https://www.ietf.org/archive/id/draft-ietf-lamps-x509-shbs-13.html#name-key- usage-bits
- [lamps] Key usage bits for end-entity certs in dr… Corey Bonnell
- [lamps] Re: Key usage bits for end-entity certs i… Mike Ounsworth
- [lamps] Re: Key usage bits for end-entity certs i… Corey Bonnell
- [lamps] Re: Key usage bits for end-entity certs i… Mike Ounsworth