Re: [lamps] draft-housley-lamps-crmf-update-algs - proposal on adding text regarding iterationCount and pwd quality

[Jonathan Hammell <[e-mail]>]

Russ, Hendrik:

On Thu, Nov 26, 2020 at 12:47 PM Russ Housley <[e-mail]> wrote:
> > Driven by the bitcoin business, highly specialized ASIC speeding up hash calculation are available for a relative cheap price. Therefore, we would propose to further update RFC4211 Section 4.4 as follows.
> >
> > Add a sentence to the end of the first paragraph of Section 4.4
> > "The security of this MAC depends heavily on the entropy of the used password. Using one-time passwords also improves the security."
>
> I would prefer to say: "The password for this MAC SHOULD NOT be used for any other purpose."  I think this avoids potential issues with repeated requests.
>
> What do others think?

I think Russ's proposal is more clear for implementers.  The proposed
text to add to the Security Considerations discusses the entropy
requirements and suggestion for one-time passwords.

I agree with the other proposed changes from Hendrick.

However, I'm concerned about the ASN.1 for PBMParameter Section 4.4 of
RFC 4211 for the following reasons.  If one wanted to use scrypt (RFC
7914) for the owf, there is duplication of the salt parameter and the
iterationCount in PBMParameter would no longer be relevant.  One might
even want to use Argon2 (draft-irtf-cfrg-argon2), but unfortunately
there is no ASN.1 module in that I-D to specify parameterization.  I
realize that backwards compatibility needs to be maintained for
PBMParameter so those parameters cannot be made OPTIONAL, but perhaps
some guidance like the following should be added?

  "If a salt value is specified in the AlgorithmIdentifier parameters
for owf (such as in [RFC7914]), the salt value in PBMParameter MUST
NOT be used and it SHOULD be the zero-length octet string.  Similarly,
if the mechanism specified in owf has its own cost parameter for
deriving a key (such as in [RFC7914]), then the iterationCount value
in PBMParameter MUST NOT be used and it SHOULD be set to 0."

Jonathan