Geoff, Roque & David,
I do not disagree with David's technical observation about the
crypto strength matching of SHA-1 and RSA 1024 However, this
observation does not mean that we have to use SHA-1 with RSA 1024,
from an architectural perspective.
We specified use of SHA-256 (as a minimum), because we want to use
that hash algorithm with larger (2048) RSA key sizes, and we wanted
to encourage support for the SHA-2 family of hash algorithms as part
of a longer term transition strategy. As the most recent version of
the CP notes, we anticipate that CAs will transition to longer keys
and/or different algorithms over time, as required to maintain
appropriate crypto security for signatures in the RPKI. I think it is
reasonable to mandate support for SHA-256 now, to get people in the
habit of using that family of hash algorithms now, as it is likely
that we will migrate to these algorithms over time.
Thus I suggest that we stick with the current hash algorithm
requirements, irrespective of key sizes. If the WG decides that we
should up the minimum key size from 1,204 bits, that's fine too, but
we need not maintain crypto security equivalence between the two
parameters based on David's observation. There can be other reasons
for selecting parameters in contexts like these.
Steve
_______________________________________________
sidr mailing list
[email protected]
https://www.ietf.org/mailman/listinfo/sidr
