< draft-ietf-curdle-cms-eddsa-signatures-03.txt		draft-ietf-curdle-cms-eddsa-signatures-04.txt >
	Internet-Draft R. Housley		Internet-Draft R. Housley
	Intended status: Standards Track Vigil Security		Intended status: Standards Track Vigil Security
	Expires: 26 July 2017 26 January 2017		Expires: 10 October 2017 10 April 2017
	Use of EdDSA Signatures in the Cryptographic Message Syntax (CMS)		Use of EdDSA Signatures in the Cryptographic Message Syntax (CMS)
	<draft-ietf-curdle-cms-eddsa-signatures-03.txt>		<draft-ietf-curdle-cms-eddsa-signatures-04.txt>
	Abstract		Abstract
	This document specifies the conventions for using Edwards-curve		This document specifies the conventions for using Edwards-curve
	Digital Signature Algorithm (EdDSA) for Curve25519 and Curve448 in		Digital Signature Algorithm (EdDSA) for Curve25519 and Curve448 in
	the Cryptographic Message Syntax (CMS). For each curve, EdDSA		the Cryptographic Message Syntax (CMS). For each curve, EdDSA
	defines the PureEdDSA and HashEdDSA modes. However, the HashEdDSA		defines the PureEdDSA and HashEdDSA modes. However, the HashEdDSA
	mode is not used with the CMS. In addition, no context string is		mode is not used with the CMS. In addition, no context string is
	used with the CMS.		used with the CMS.
	skipping to change at page 1, line 34 ¶		skipping to change at page 1, line 34 ¶
	Internet-Drafts are working documents of the Internet Engineering		Internet-Drafts are working documents of the Internet Engineering
	Task Force (IETF). Note that other groups may also distribute		Task Force (IETF). Note that other groups may also distribute
	working documents as Internet-Drafts. The list of current Internet-		working documents as Internet-Drafts. The list of current Internet-
	Drafts is at http://datatracker.ietf.org/drafts/current/.		Drafts is at http://datatracker.ietf.org/drafts/current/.
	Internet-Drafts are draft documents valid for a maximum of six months		Internet-Drafts are draft documents valid for a maximum of six months
	and may be updated, replaced, or obsoleted by other documents at any		and may be updated, replaced, or obsoleted by other documents at any
	time. It is inappropriate to use Internet-Drafts as reference		time. It is inappropriate to use Internet-Drafts as reference
	material or to cite them other than as "work in progress."		material or to cite them other than as "work in progress."
	This Internet-Draft will expire on 26 July 2017.		This Internet-Draft will expire on 10 October 2017.
	Copyright Notice		Copyright Notice
	Copyright (c) 2017 IETF Trust and the persons identified as the		Copyright (c) 2017 IETF Trust and the persons identified as the
	document authors. All rights reserved.		document authors. All rights reserved.
	This document is subject to BCP 78 and the IETF Trust's Legal		This document is subject to BCP 78 and the IETF Trust's Legal
	Provisions Relating to IETF Documents		Provisions Relating to IETF Documents
	(http://trustee.ietf.org/license-info) in effect on the date of		(http://trustee.ietf.org/license-info) in effect on the date of
	publication of this document. Please review these documents		publication of this document. Please review these documents
	skipping to change at page 3, line 49 ¶		skipping to change at page 3, line 49 ¶
	Signing with Ed25519 uses SHA-512 as part of the signing operation,		Signing with Ed25519 uses SHA-512 as part of the signing operation,
	and signing with Ed448 uses SHAKE256 as part of the signing		and signing with Ed448 uses SHAKE256 as part of the signing
	operation.		operation.
	For convenience, the object identifiers and parameter syntax for		For convenience, the object identifiers and parameter syntax for
	these algorithms are repeated here:		these algorithms are repeated here:
	hashAlg-SHA-512 ALGORITHM ::= { OID id-sha512 }		hashAlg-SHA-512 ALGORITHM ::= { OID id-sha512 }
	hashAlg-SHAKE256 ALGORITHM ::= { OID id-shake256 }		hashAlg-SHAKE256 ALGORITHM ::= { OID id-shake256 }
	hashAlg-SHAKE256-LEN ALGORITHM ::= { OID id-shake256-len		hashAlg-SHAKE256-LEN ALGORITHM ::= { OID id-shake256-len
	PARMS ShakeOutputLen }		PARMS ShakeOutputLen }
	hashalgs OBJECT IDENTIFIER ::= { joint-iso-itu-t(2)		hashalgs OBJECT IDENTIFIER ::= { joint-iso-itu-t(2)
	country(16) us(840) organization(1)		country(16) us(840) organization(1)
	gov(101) csor(3) nistalgorithm(4) 2 }		gov(101) csor(3) nistalgorithm(4) 2 }
	id-sha512 OBJECT IDENTIFIER ::= { hashAlgs 3 }		id-sha512 OBJECT IDENTIFIER ::= { hashAlgs 3 }
	skipping to change at page 7, line 5 ¶		skipping to change at page 7, line 5 ¶
	Using the same private key for different algorithms has the potential		Using the same private key for different algorithms has the potential
	of allowing an attacker to get extra information about the private		of allowing an attacker to get extra information about the private
	key. For this reason, the same private key SHOULD NOT be used with		key. For this reason, the same private key SHOULD NOT be used with
	more than one EdDSA set of parameters. For example, do not use the		more than one EdDSA set of parameters. For example, do not use the
	same private key with PureEdDSA and HashEdDSA.		same private key with PureEdDSA and HashEdDSA.
	When computing signatures, the same hash function should be used for		When computing signatures, the same hash function should be used for
	all operations. This reduces the number of failure points in the		all operations. This reduces the number of failure points in the
	signature process.		signature process.
	6. Acknowledgements		6. IANA Considerations
	Many thanks to Jim Schaad for the careful review and comment on the		This document requires no actions by IANA.
	draft document. Thanks to Quynh Dang with the object identifiers
	that were assigned by NIST.
	7. Normative References		7. Acknowledgements
			Many thanks to Jim Schaad and Daniel Migault for the careful review
			and comment on the draft document. Thanks to Quynh Dang for
			coordinating the object identifiers assignment by NIST.
			8. Normative References
	[CMS] Housley, R., "Cryptographic Message Syntax (CMS)",		[CMS] Housley, R., "Cryptographic Message Syntax (CMS)",
	RFC 5652, September 2009.		RFC 5652, September 2009.
	[CURDLE-PKIX]		[CURDLE-PKIX]
	Josefsson, S., and J. Schaad, "Algorithm Identifiers for		Josefsson, S., and J. Schaad, "Algorithm Identifiers for
	Ed25519, Ed25519ph, Ed448, Ed448ph, X25519 and X448 for		Ed25519, Ed25519ph, Ed448, Ed448ph, X25519 and X448 for
	use in the Internet X.509 Public Key Infrastructure",		use in the Internet X.509 Public Key Infrastructure",
	draft-ietf-curdle-pkix-02, 31 October 2016,		draft-ietf-curdle-pkix-02, 31 October 2016,
	Work-in-progress.		Work-in-progress.
	skipping to change at page 7, line 47 ¶		skipping to change at page 8, line 5 ¶
	[X680] ITU-T, "Information technology -- Abstract Syntax Notation		[X680] ITU-T, "Information technology -- Abstract Syntax Notation
	One (ASN.1): Specification of basic notation", ITU-T		One (ASN.1): Specification of basic notation", ITU-T
	Recommendation X.680, 2015.		Recommendation X.680, 2015.
	[X690] ITU-T, "Information technology -- ASN.1 encoding rules:		[X690] ITU-T, "Information technology -- ASN.1 encoding rules:
	Specification of Basic Encoding Rules (BER), Canonical		Specification of Basic Encoding Rules (BER), Canonical
	Encoding Rules (CER) and Distinguished Encoding Rules		Encoding Rules (CER) and Distinguished Encoding Rules
	(DER)", ITU-T Recommendation X.690, 2015.		(DER)", ITU-T Recommendation X.690, 2015.
	8. Informative References		9. Informative References
	[RANDOM] Eastlake, D., Schiller, J., and S. Crocker, "Randomness		[RANDOM] Eastlake, D., Schiller, J., and S. Crocker, "Randomness
	Requirements for Security", RFC 4086, June 2005.		Requirements for Security", RFC 4086, June 2005.
	Author Address		Author's Address
	Russ Housley		Russ Housley
	918 Spring Knoll Drive		918 Spring Knoll Drive
	Herndon, VA 20170		Herndon, VA 20170
	USA		USA
	housley@vigilsec.com		housley@vigilsec.com
End of changes. 9 change blocks.
	11 lines changed or deleted		15 lines changed or added
This html diff was produced by rfcdiff 1.48. The latest version is available from http://tools.ietf.org/tools/rfcdiff/