Re: [lamps] New Version Notification for draft-ietf-lamps-pkix-shake-04.txt

[Russ Housley <[e-mail]>]

I have two comments and one suggestion.

1) Section 5.1.1: The third paragraph is describing a replacement for MGF1 defined in Section B.2.1 of RFC 8017. You are avoiding the use of RSASSA-PSS-params; it would be good to be explicit about that.

RFC 4055 specifies this structure:

      RSASSA-PSS-params  ::=  SEQUENCE  {
         hashAlgorithm      [0] HashAlgorithm DEFAULT
                                   sha1Identifier,
         maskGenAlgorithm   [1] MaskGenAlgorithm DEFAULT
                                   mgf1SHA1Identifier,
         saltLength         [2] INTEGER DEFAULT 20,
         trailerField       [3] INTEGER DEFAULT 1  }

This section is telling the implementer how to handle each of these parameters since they are now all bundled into the top-level OID.

2) I do not think that most of section 5.2 is needed.

I think you can simply point to RFC 4055 for RSASSA-PSS public keys, but keep this paragraph:

   Additionally, when the RSA private key owner wishes to limit the use
   of the public key exclusively to RSASSA-PSS, the AlgorithmIdentifiers
   for RSASSA-PSS defined in Section 4 can be used as the algorithm
   field in the SubjectPublicKeyInfo sequence [RFC5280].  The identifier
   parameters, as explained in section Section 4, MUST be absent. 

That said, I think the OIDs in Section 4 are used when the RSA private key owner wishes to limit the use to RSASSA-PSS with SHAKE.

I think you can simply point to RFC 5480 for ECDSA public keys.  I do not see any additional information that is specific to the use of SHAKE here.

3) I suggest that "joint-iso-ccitt" be replaced by "joint-iso-itu-t" throughout the document.  Right now, it is using both of these names.

Russ

P.S.  I have not tried to compile the ASN.1.


> From: [e-mail] <[e-mail]> 
> Sent: Sunday, November 25, 2018 11:49 PM
> To: Quynh Dang <[e-mail]>; Panos Kampanakis (pkampana) <[e-mail]>
> Subject: New Version Notification for draft-ietf-lamps-pkix-shake-04.txt
> 
> 
> A new version of I-D, draft-ietf-lamps-pkix-shake-04.txt
> has been successfully submitted by Panos Kampanakis and posted to the IETF repository.
> 
> Name:		draft-ietf-lamps-pkix-shake
> Revision:	04
> Title:		Internet X.509 Public Key Infrastructure: Additional Algorithm Identifiers for RSASSA-PSS and ECDSA using SHAKEs
> Document date:	2018-11-25
> Group:		lamps
> Pages:		15
> URL:            https://www.ietf.org/internet-drafts/draft-ietf-lamps-pkix-shake-04.txt
> Status:         https://datatracker.ietf.org/doc/draft-ietf-lamps-pkix-shake/
> Htmlized:       https://tools.ietf.org/html/draft-ietf-lamps-pkix-shake-04
> Htmlized:       https://datatracker.ietf.org/doc/html/draft-ietf-lamps-pkix-shake
> Diff:           https://www.ietf.org/rfcdiff?url2=draft-ietf-lamps-pkix-shake-04
> 
> Abstract:
>   Digital signatures are used to sign messages, X.509 certificates and
>   CRLs (Certificate Revocation Lists).  This document describes the
>   conventions for using the SHAKE function family in Internet X.509
>   certificates and CRLs as one-way hash functions with the RSA
>   Probabilistic signature and ECDSA signature algorithms.  The
>   conventions for the associated subject public keys are also
>   described.
> 
> Please note that it may take a couple of minutes from the time of submission until the htmlized version and diff are available at tools.ietf.org.
> 
> The IETF Secretariat
>