2. Algorithm and Key Size This profile specifies the use of the RSA algorithm [RFC3447] to compute the signature of certificates, CRLs and signed objects in the context of the RPKI. This profile specifies a default of SHA-256 with RSA (sha256WithRSAEncryption), and allows for the use of SHA-384 (sha384WithRSAEncryption) or SHA-512 (sha384WithRSAEncryption).
>> Typo: s/512 (sha384/512 (sha512/
Accordingly, The OID values used in the RPKI for such
signatures MUST
be one of { pkcs-1 11 }, { pkcs-1 12 } or { pkcs-1 13 }
[RFC4055].
The required RSA key size MUST be 2048 bits.
The public exponent (e) of the RSA algorithm is F4
(65,537).
>> Why allow all three hash functions. Since you are
specifying a particular key size, it seems better to select the hash
function that matches that key size.>> I can see an argument for MUST SHA-256 and SHOULD SHA-384 as an indicator that the longer has will be needed in the future.
Russ
_______________________________________________ sidr mailing list [email protected] https://www.ietf.org/mailman/listinfo/sidr
