IETF Logo Mail Archive

Re: [stir] Choice of STIR signature algorithm

Russ Housley <housley@vigilsec.com> Wed, 25 May 2016 19:42 UTC

Return-Path: <housley@vigilsec.com>
X-Original-To: stir@ietfa.amsl.com
Delivered-To: stir@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3100512DC1D for <stir@ietfa.amsl.com>; Wed, 25 May 2016 12:42:08 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -101.899
X-Spam-Level:
X-Spam-Status: No, score=-101.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, USER_IN_WHITELIST=-100] autolearn=ham autolearn_force=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id V5MwEgbZ3ev6 for <stir@ietfa.amsl.com>; Wed, 25 May 2016 12:42:07 -0700 (PDT)
Received: from mail.smetech.net (x-bolt-wan.smeinc.net [209.135.219.146]) by ietfa.amsl.com (Postfix) with ESMTP id BCD5F12DCEB for <stir@ietf.org>; Wed, 25 May 2016 12:41:12 -0700 (PDT)
Received: from localhost (ronin.smetech.net [209.135.209.5]) by mail.smetech.net (Postfix) with ESMTP id B82C5F240DC for <stir@ietf.org>; Wed, 25 May 2016 15:41:12 -0400 (EDT)
X-Virus-Scanned: amavisd-new at smetech.net
Received: from mail.smetech.net ([209.135.209.4]) by localhost (ronin.smeinc.net [209.135.209.5]) (amavisd-new, port 10024) with ESMTP id vLdLM2uiohBU for <stir@ietf.org>; Wed, 25 May 2016 15:23:29 -0400 (EDT)
Received: from [192.168.2.100] (pool-108-51-128-219.washdc.fios.verizon.net [108.51.128.219]) (using TLSv1 with cipher AES128-SHA (128/128 bits)) (No client certificate requested) by mail.smetech.net (Postfix) with ESMTP id 5A402F240D9 for <stir@ietf.org>; Wed, 25 May 2016 15:41:12 -0400 (EDT)
From: Russ Housley <housley@vigilsec.com>
Content-Type: multipart/alternative; boundary="Apple-Mail=_5145C337-286D-4E19-847A-216570C387AE"
Message-Id: <789A387A-B0E2-4DF6-9807-55E0210AEEBD@vigilsec.com>
Mime-Version: 1.0 (Mac OS X Mail 7.3 \(1878.6\))
Date: Wed, 25 May 2016 15:41:18 -0400
References: <D32953D1.4770F%john.mattsson@ericsson.com> <1A843300-AEB7-4EC6-8256-C88F6847B82E@neustar.biz> <D329995E.477D9%john.mattsson@ericsson.com> <A3723DBB-476C-4F22-95E0-37AE0872FBBD@shockey.us> <F4F09888-780B-4725-9A74-AD2EF661C5C0@vigilsec.com> <0DD82221-E79D-4F15-B2B5-93165EC98919@shockey.us> <570534D4.6010707@nostrum.com> <5195FEBC-8395-4E77-B768-2B2D81144121@shockey.us> <56DF2D20-9381-45CB-8057-6B1AB99B05E9@chriswendt.net> <BB4B8171-BF3E-4D3F-B81B-73AC9768ED75@shockey.us> <D3316C0C.485E4%john.mattsson@ericsson.com> <2EC06927-2614-491E-A499-C86ABB30573C@chriswendt.net> <26AE9662-B919-4B22-AFF8-45CF351AA03F@vigilsec.com> <2C466A8A-D638-49AE-9698-699D67762FF1@standardstrack.com> <EED4C512-B57C-47EC-9CE4-07C64365D246@vigilsec.com> <CABcZeBN3OLiaea10cWrtyv6R9KxHHVMuAsC56o=xmj6MWn_RYg@mail.gmail.com> <AA4D2199-3A8D-4015-86F3-DEE04120E51C@vigilsec.com> <CABcZeBPSLDeSLRgAyBqCR_K_-=F6Fck+CBZ1rSnLj7CNpDrGAA@mail.gmail.com> <43E97208-EBA0-4DE6-8CB7-E9AAFD212A3B@chriswendt.net > <F5BBF57F-840C-479E-9907-D3CA8002D101@standardstrack.com>
To: IETF STIR Mail List <stir@ietf.org>
In-Reply-To: <F5BBF57F-840C-479E-9907-D3CA8002D101@standardstrack.com>
X-Mailer: Apple Mail (2.1878.6)
Archived-At: <http://mailarchive.ietf.org/arch/msg/stir/okVGRmeuH2dAw8t9K0DtnLBvAdc>
Subject: Re: [stir] Choice of STIR signature algorithm
X-BeenThere: stir@ietf.org
X-Mailman-Version: 2.1.17
Precedence: list
List-Id: Secure Telephone Identity Revisited <stir.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/stir>, <mailto:stir-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/stir/>
List-Post: <mailto:stir@ietf.org>
List-Help: <mailto:stir-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/stir>, <mailto:stir-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 25 May 2016 19:42:08 -0000

This is what I am hearing…

        MUST support ECDSA with P-256 for PASSporT signatures

and

        MUST support ECDSA with P-256 for certificate signatures
        MUST support RSA PKCS#1 v1.5 for certificate signatures

Then, we should say something to product planners that at some point in the future, we expect support for RSA to be downgraded.

Russ

v2.40.4 | Report a Bug | By Email | System Status