Re: [lamps] draft-housley-lamps-crmf-update-algs - proposal on adding text regarding iterationCount and pwd quality

[Russ Housley <[e-mail]>]

Jonathan:

> On Thu, Nov 26, 2020 at 12:47 PM Russ Housley <[e-mail]> wrote:
>>> Driven by the bitcoin business, highly specialized ASIC speeding up hash calculation are available for a relative cheap price. Therefore, we would propose to further update RFC4211 Section 4.4 as follows.
>>> 
>>> Add a sentence to the end of the first paragraph of Section 4.4
>>> "The security of this MAC depends heavily on the entropy of the used password. Using one-time passwords also improves the security."
>> 
>> I would prefer to say: "The password for this MAC SHOULD NOT be used for any other purpose."  I think this avoids potential issues with repeated requests.
>> 
>> What do others think?
> 
> I think Russ's proposal is more clear for implementers.  The proposed
> text to add to the Security Considerations discusses the entropy
> requirements and suggestion for one-time passwords.
> 
> I agree with the other proposed changes from Hendrick.
> 
> However, I'm concerned about the ASN.1 for PBMParameter Section 4.4 of
> RFC 4211 for the following reasons.  If one wanted to use scrypt (RFC
> 7914) for the owf, there is duplication of the salt parameter and the
> iterationCount in PBMParameter would no longer be relevant.  One might
> even want to use Argon2 (draft-irtf-cfrg-argon2), but unfortunately
> there is no ASN.1 module in that I-D to specify parameterization.  I
> realize that backwards compatibility needs to be maintained for
> PBMParameter so those parameters cannot be made OPTIONAL, but perhaps
> some guidance like the following should be added?
> 
>  "If a salt value is specified in the AlgorithmIdentifier parameters
> for owf (such as in [RFC7914]), the salt value in PBMParameter MUST
> NOT be used and it SHOULD be the zero-length octet string.  Similarly,
> if the mechanism specified in owf has its own cost parameter for
> deriving a key (such as in [RFC7914]), then the iterationCount value
> in PBMParameter MUST NOT be used and it SHOULD be set to 0."

I do not think I agree.  If you want to use one of these other constructions, wouldn't completely replace id-PasswordBasedMAC?

Russ