On Jul 21, 2009, at 8:25 PM, Stephen Kent wrote:
Geoff, Roque & David,
I do not disagree with David's technical observation about the
crypto strength matching of SHA-1 and RSA 1024 However, this
observation does not mean that we have to use SHA-1 with RSA 1024,
from an architectural perspective.
We specified use of SHA-256 (as a minimum), because we want to use
that hash algorithm with larger (2048) RSA key sizes, and we wanted
to encourage support for the SHA-2 family of hash algorithms as part
of a longer term transition strategy. As the most recent version of
the CP notes, we anticipate that CAs will transition to longer keys
and/or different algorithms over time, as required to maintain
appropriate crypto security for signatures in the RPKI. I think it
is reasonable to mandate support for SHA-256 now, to get people in
the habit of using that family of hash algorithms now, as it is
likely that we will migrate to these algorithms over time.
Thus I suggest that we stick with the current hash algorithm
requirements, irrespective of key sizes. If the WG decides that we
should up the minimum key size from 1,204 bits, that's fine too, but
we need not maintain crypto security equivalence between the two
parameters based on David's observation. There can be other reasons
for selecting parameters in contexts like these.
SHA-1 is risky for digital signatures, but 1024 RSA key is ok at
least until the end of 2010( as per NSIT-800-57)
and even after (https://documents.epfl.ch/users/l/le/lenstra/public/papers/ecdl.pdf
)
--alain
_______________________________________________
sidr mailing list
[email protected]
https://www.ietf.org/mailman/listinfo/sidr
