Re: [lamps] How to deal with Triple-DES in CMP Algorithms
Russ Housley <housley@vigilsec.com> Fri, 23 October 2020 16:24 UTC
Return-Path: <housley@vigilsec.com>
X-Original-To: spasm@ietfa.amsl.com
Delivered-To: spasm@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2E4813A0C73 for <spasm@ietfa.amsl.com>; Fri, 23 Oct 2020 09:24:10 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.897
X-Spam-Level:
X-Spam-Status: No, score=-1.897 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 0CY3OVRYXwtx for <spasm@ietfa.amsl.com>; Fri, 23 Oct 2020 09:24:08 -0700 (PDT)
Received: from mail.smeinc.net (mail.smeinc.net [209.135.209.11]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 77C073A0C61 for <spasm@ietf.org>; Fri, 23 Oct 2020 09:24:08 -0700 (PDT)
Received: from localhost (localhost [127.0.0.1]) by mail.smeinc.net (Postfix) with ESMTP id D3156300AF2 for <spasm@ietf.org>; Fri, 23 Oct 2020 12:24:05 -0400 (EDT)
X-Virus-Scanned: amavisd-new at mail.smeinc.net
Received: from mail.smeinc.net ([127.0.0.1]) by localhost (mail.smeinc.net [127.0.0.1]) (amavisd-new, port 10026) with ESMTP id nB2gTHL-uP78 for <spasm@ietf.org>; Fri, 23 Oct 2020 12:24:04 -0400 (EDT)
Received: from [192.168.1.161] (pool-141-156-161-153.washdc.fios.verizon.net [141.156.161.153]) by mail.smeinc.net (Postfix) with ESMTPSA id 87B9E300A3B; Fri, 23 Oct 2020 12:24:04 -0400 (EDT)
Content-Type: text/plain; charset="us-ascii"
Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.17\))
From: Russ Housley <housley@vigilsec.com>
In-Reply-To: <AM0PR10MB2418DD5F5C458CA90F588BA7FE1A0@AM0PR10MB2418.EURPRD10.PROD.OUTLOOK.COM>
Date: Fri, 23 Oct 2020 12:24:05 -0400
Cc: "spasm@ietf.org" <spasm@ietf.org>
Content-Transfer-Encoding: quoted-printable
Message-Id: <B638A54C-2B24-438A-B40A-93BA6661F22F@vigilsec.com>
References: <AM0PR10MB2418DD5F5C458CA90F588BA7FE1A0@AM0PR10MB2418.EURPRD10.PROD.OUTLOOK.COM>
To: "Brockhaus, Hendrik" <hendrik.brockhaus@siemens.com>
X-Mailer: Apple Mail (2.3445.104.17)
Archived-At: <https://mailarchive.ietf.org/arch/msg/spasm/vnQ0m3H_V4P86JRkmqnF0Ex8tR8>
Subject: Re: [lamps] How to deal with Triple-DES in CMP Algorithms
X-BeenThere: spasm@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: "This is a venue for discussion of doing Some Pkix And SMime \(spasm\) work." <spasm.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/spasm>, <mailto:spasm-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/spasm/>
List-Post: <mailto:spasm@ietf.org>
List-Help: <mailto:spasm-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/spasm>, <mailto:spasm-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 23 Oct 2020 16:24:10 -0000
S/MIME has moved to AES. First it became a SHOULD, and then a MUST.
Changes from S/MIME v3 to S/MIME v3.1 included:
- The AES symmetric encryption algorithm has been included as a
SHOULD implement.
Changes from S/MIME v3.1 to S/MIME v3.2 includes:
- Section 2.5.2: Replaced reference "sha1WithRSAEncryption" with
"sha256WithRSAEncryption", replaced "DES-3EDE-CBC" with "AES-128
CBC", and deleted the RC5 example.
Changes for S/MIME v4.0 includes:
- Updated the content-encryption algorithms (Sections 2.7 and
2.7.1.2): added AES-256 Galois/Counter Mode (GCM), added
ChaCha20-Poly1305, removed mention of AES-192 Cipher Block
Chaining (CBC), and marked tripleDES as historic.
Russ
> On Oct 23, 2020, at 12:12 PM, Brockhaus, Hendrik <hendrik.brockhaus@siemens.com> wrote:
>
> In CMP (RFC 4210) Triple-DES CBC is used for encrypted key transport.
> In CMS Algorithms (RFC 3370) Triple-DES key wrap and CBC is specified.
> In RFC 8429 Triple-DES is deprecated for use in Kerberos.
> I see Triple-DES still in use for S/MIME and elsewhere.
>
> Currently I am writing the I-D on CMP Algorithms.
> Should I specify Triple-DES as an alternative to AES or should I drop it?
>
> Hendrik
>
>
> Hendrik Brockhaus
> Siemens AG
> mailto:hendrik.brockhaus@siemens.com
>
> www.siemens.com
>
> Siemens Aktiengesellschaft: Chairman of the Supervisory Board: Jim Hagemann Snabe; Managing Board: Joe Kaeser, Chairman, President and Chief Executive Officer; Roland Busch, Klaus Helmrich, Cedrik Neike, Matthias Rebellius, Ralf P. Thomas, Judith Wiese; Registered offices: Berlin and Munich, Germany; Commercial registries: Berlin-Charlottenburg, HRB 12300, Munich, HRB 6684; WEEE-Reg.-No. DE 23691322
- [lamps] How to deal with Triple-DES in CMP Algori… Brockhaus, Hendrik
- Re: [lamps] How to deal with Triple-DES in CMP Al… Russ Housley