Re: [lamps] Composite Keys: Explicit vs Generic Algorithm Combinations

[Mike Ounsworth <[e-mail]>]

Oops, I didn't realize this was on-list. I'll add some more context.

I agree with Jan's Pros / Cons list, and from LAMPS 115 it seems like we have supporters of both Explicit and Generic. I feel like this debate will not have a satisfying conclusion because of the diverse set of uses of X.509.

We are preparing new versions of the composite drafts, and we are leaving Generic in as an optional-to-implement algorithm type. Unless there are strong objections to that, then I think we'll just leave it there.

---
Mike Ounsworth

-----Original Message-----
From: Spasm <[e-mail]> On Behalf Of Mike Ounsworth
Sent: December 7, 2022 9:45 AM
To: Klaußner, Jan <[e-mail]>; [e-mail]
Subject: [EXTERNAL] Re: [lamps] Composite Keys: Explicit vs Generic Algorithm Combinations

WARNING: This email originated outside of Entrust.
DO NOT CLICK links or attachments unless you trust the sender and know the content is safe.

______________________________________________________________________
Hi Jan,

I that list looks good to me!

---
Mike Ounsworth

-----Original Message-----
From: Spasm <[e-mail]> On Behalf Of Klaußner, Jan
Sent: December 7, 2022 9:07 AM
To: [e-mail]
Subject: [EXTERNAL] [lamps] Composite Keys: Explicit vs Generic Algorithm Combinations

WARNING: This email originated outside of Entrust.
DO NOT CLICK links or attachments unless you trust the sender and know the content is safe.

______________________________________________________________________
Dear all,

In the last meeting we agreed to carry the discussion about explicit vs generic definitions to the mailing list. I collected some of the Pro and Cons here for a start:

1) Explicit definition

Pro:
a) easy checking for algorithm support (for any possible combination only one OID must fit) b limited implementation choices
c) if the developer knows the effect of a combination, he only needs one OID for that combination - allows a simpler usage by application developers
d) PGP WG does it the same

Contra:
a) chosen algorithm combinations may not cover all use cases
b) new OID for each new combination -> limited agility, standardizing OIDs takes time, must be synchronized with new algorithm OIDs
c) explosion of combinations may lead to increased implementation efforts


2) Generic definition

Pro:
a) simple definition and implementation
b) one mechanism fits all use cases, e.g. also smartcards, VPN etc, so we do not need to foresee all use cases
c) better agility - switching component algorithms in combinations only requires the support of  the new algorithm in crypto-lib

Contra:
a) algorithm support check is harder (needs at least parsing of all component
keys/signatures)
b) Developers also need to know the component algorithms here (key size,
performance)


For myself I have a strong focus on cryptographic agility and am voting for the generic approach.

Looking forward to an interesting discussion

Jan Klaußner
Senior Product Architect
GF, GFL
------------------------------------------------------------------
D-Trust GmbH
Kommandantenstr. 15
10969 Berlin, Germany

M + 49 (0) 151 5600 1986
[e-mail]
[e-mail]
https://urldefense.com/v3/__http://www.d-trust.net__;!!FJ-Y8qCqXTj2!YTUXWuF5Hdho4E4q4DyGGN7sVIt6JsqGcsNDti3cweeM_yYZMF9twyiBysv1jtT8BLbZAk0ql63dQxSGMSVpm0IH4MXLUGNWU_KGg4974A$ 

Part of the Bundesdruckerei Group

Head Office: Berlin
Commercial Register: AG Berlin-Charlottenburg. HRB 74346, VAT ID: DE
202620438
Board of Management: Dr. Kim Nguyen, Dr. Martin Riegel

The companies of the Bundesdruckerei Group are committed to protecting your personal data and they adhere strictly to the relevant rules of the General Data Protection Regulation and the Federal Data Protection Act. We are therefore informing you that personal data will be collected and may be stored as part of our electronic communications. This data processing is carried out exclusively for business purposes. You have the right to request information regarding your personal data stored by us. If you wish to do so, please contact: [e-mail]. More information about your rights and the contact details of our data protection officer can be found at:
https://urldefense.com/v3/__https://www.d-trust.net/privacy-policy.html__;!!FJ-Y8qCqXTj2!YTUXWuF5Hdho4E4q4DyGGN7sVIt6JsqGcsNDti3cweeM_yYZMF9twyiBysv1jtT8BLbZAk0ql63dQxSGMSVpm0IH4MXLUGNWU_LX7Z6c7Q$  .

This message is intended only for the use of the individual or entity to which it is addressed, and may contain information that is privileged, confidential and exempt from disclosure under applicable law. If the reader of this message is not the intended recipient, or the employee or agent responsible for delivering the message to the intended recipient, we hereby give notice that any dissemination, distribution or copying of this communication is strictly prohibited. If you have received this message in error, please delete the message and notify us immediately.


Any email and files/attachments transmitted with it are confidential and are intended solely for the use of the individual or entity to whom they are addressed. If this message has been sent to you in error, you must not copy, distribute or disclose of the information it contains. Please notify Entrust immediately and delete the message from your system.

_______________________________________________
Spasm mailing list
[e-mail]
https://urldefense.com/v3/__https://www.ietf.org/mailman/listinfo/spasm__;!!FJ-Y8qCqXTj2!YTUXWuF5Hdho4E4q4DyGGN7sVIt6JsqGcsNDti3cweeM_yYZMF9twyiBysv1jtT8BLbZAk0ql63dQxSGMSVpm0IH4MXLUGNWU_JUGv6gkQ$