< draft-ietf-lamps-crmf-update-algs-03.txt		draft-ietf-lamps-crmf-update-algs-04.txt >
	Network Working Group R. Housley		Network Working Group R. Housley
	Internet-Draft Vigil Security		Internet-Draft Vigil Security
	Updates: 4211 (if approved) 29 January 2021		Updates: 4211 (if approved) 19 February 2021
	Intended status: Standards Track		Intended status: Standards Track
	Expires: 2 August 2021		Expires: 23 August 2021
	Algorithm Requirements Update to the Internet X.509 Public Key		Algorithm Requirements Update to the Internet X.509 Public Key
	Infrastructure Certificate Request Message Format (CRMF)		Infrastructure Certificate Request Message Format (CRMF)
	draft-ietf-lamps-crmf-update-algs-03		draft-ietf-lamps-crmf-update-algs-04
	Abstract		Abstract
	This document updates the cryptographic algorithm requirements for		This document updates the cryptographic algorithm requirements for
	the Password-Based Message Authentication Code in the Internet X.509		the Password-Based Message Authentication Code in the Internet X.509
	Public Key Infrastructure Certificate Request Message Format (CRMF)		Public Key Infrastructure Certificate Request Message Format (CRMF)
	specified in RFC 4211.		specified in RFC 4211.
	Status of This Memo		Status of This Memo
	skipping to change at page 1, line 35 ¶		skipping to change at page 1, line 35 ¶
	Internet-Drafts are working documents of the Internet Engineering		Internet-Drafts are working documents of the Internet Engineering
	Task Force (IETF). Note that other groups may also distribute		Task Force (IETF). Note that other groups may also distribute
	working documents as Internet-Drafts. The list of current Internet-		working documents as Internet-Drafts. The list of current Internet-
	Drafts is at https://datatracker.ietf.org/drafts/current/.		Drafts is at https://datatracker.ietf.org/drafts/current/.
	Internet-Drafts are draft documents valid for a maximum of six months		Internet-Drafts are draft documents valid for a maximum of six months
	and may be updated, replaced, or obsoleted by other documents at any		and may be updated, replaced, or obsoleted by other documents at any
	time. It is inappropriate to use Internet-Drafts as reference		time. It is inappropriate to use Internet-Drafts as reference
	material or to cite them other than as "work in progress."		material or to cite them other than as "work in progress."
	This Internet-Draft will expire on 2 August 2021.		This Internet-Draft will expire on 23 August 2021.
	Copyright Notice		Copyright Notice
	Copyright (c) 2021 IETF Trust and the persons identified as the		Copyright (c) 2021 IETF Trust and the persons identified as the
	document authors. All rights reserved.		document authors. All rights reserved.
	This document is subject to BCP 78 and the IETF Trust's Legal		This document is subject to BCP 78 and the IETF Trust's Legal
	Provisions Relating to IETF Documents (https://trustee.ietf.org/		Provisions Relating to IETF Documents (https://trustee.ietf.org/
	license-info) in effect on the date of publication of this document.		license-info) in effect on the date of publication of this document.
	Please review these documents carefully, as they describe your rights		Please review these documents carefully, as they describe your rights
	skipping to change at page 2, line 15 ¶		skipping to change at page 2, line 15 ¶
	Table of Contents		Table of Contents
	1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 2		1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 2
	2. Terminology . . . . . . . . . . . . . . . . . . . . . . . . . 2		2. Terminology . . . . . . . . . . . . . . . . . . . . . . . . . 2
	3. Signature Key POP . . . . . . . . . . . . . . . . . . . . . . 2		3. Signature Key POP . . . . . . . . . . . . . . . . . . . . . . 2
	4. Password-Based Message Authentication Code . . . . . . . . . 3		4. Password-Based Message Authentication Code . . . . . . . . . 3
	4.1. Introduction Paragraph . . . . . . . . . . . . . . . . . 3		4.1. Introduction Paragraph . . . . . . . . . . . . . . . . . 3
	4.2. One-Way Function . . . . . . . . . . . . . . . . . . . . 3		4.2. One-Way Function . . . . . . . . . . . . . . . . . . . . 3
	4.3. Iteration Count . . . . . . . . . . . . . . . . . . . . . 4		4.3. Iteration Count . . . . . . . . . . . . . . . . . . . . . 4
	4.4. MAC Algorithm . . . . . . . . . . . . . . . . . . . . . . 4		4.4. MAC Algorithm . . . . . . . . . . . . . . . . . . . . . . 4
	5. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 6		5. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 5
	6. Security Considerations . . . . . . . . . . . . . . . . . . . 6		6. Security Considerations . . . . . . . . . . . . . . . . . . . 6
	7. Acknowledgements . . . . . . . . . . . . . . . . . . . . . . 6		7. Acknowledgements . . . . . . . . . . . . . . . . . . . . . . 6
	8. References . . . . . . . . . . . . . . . . . . . . . . . . . 6		8. References . . . . . . . . . . . . . . . . . . . . . . . . . 6
	8.1. Normative References . . . . . . . . . . . . . . . . . . 6		8.1. Normative References . . . . . . . . . . . . . . . . . . 6
	8.2. Informative References . . . . . . . . . . . . . . . . . 7		8.2. Informative References . . . . . . . . . . . . . . . . . 7
	Author's Address . . . . . . . . . . . . . . . . . . . . . . . . 8		Author's Address . . . . . . . . . . . . . . . . . . . . . . . . 8
	1. Introduction		1. Introduction
	This document updates the cryptographic algorithm requirements for		This document updates the cryptographic algorithm requirements for
	skipping to change at page 2, line 49 ¶		skipping to change at page 2, line 49 ¶
	capitals, as shown here.		capitals, as shown here.
	3. Signature Key POP		3. Signature Key POP
	Section 4.1 of [RFC4211] specifies the Proof-of-Possession (POP)		Section 4.1 of [RFC4211] specifies the Proof-of-Possession (POP)
	processing. This section is updated to explicitly allow the use of		processing. This section is updated to explicitly allow the use of
	the PBMAC1 algorithm presented in Section 7.1 of [RFC8018].		the PBMAC1 algorithm presented in Section 7.1 of [RFC8018].
	OLD:		OLD:
	algId identifies the algorithm used to compute the MAC value. All		algId identifies the algorithm used to compute the MAC value. All
	implementations MUST support id-PasswordBasedMAC. The details on		implementations MUST support id-PasswordBasedMAC. The details on
	this algorithm are presented in section 4.4		this algorithm are presented in section 4.4
	NEW:		NEW:
	algId identifies the algorithm used to compute the MAC value. All		algId identifies the algorithm used to compute the MAC value. All
	implementations MUST support id-PasswordBasedMAC as presented in		implementations MUST support id-PasswordBasedMAC as presented in
	Section 4.4 of this document. Implementations MAY also support		Section 4.4 of this document. Implementations MAY also support
	PBMAC1 presented in Section 7.1 of [RFC8018].		PBMAC1 presented in Section 7.1 of [RFC8018].
	4. Password-Based Message Authentication Code		4. Password-Based Message Authentication Code
	Section 4.4 of [RFC4211] specifies a Password-Based MAC that relies		Section 4.4 of [RFC4211] specifies a Password-Based MAC that relies
	on a one-way function to compute a symmetric key from the password		on a one-way function to compute a symmetric key from the password
	and a MAC algorithm. This section specifies algorithm requirements		and a MAC algorithm. This section specifies algorithm requirements
	for the one-way function and the MAC algorithm.		for the one-way function and the MAC algorithm.
	4.1. Introduction Paragraph		4.1. Introduction Paragraph
	skipping to change at page 6, line 46 ¶		skipping to change at page 6, line 42 ¶
	updated by this specification.		updated by this specification.
	When a Password-Based MAC is used, implementations must protect the		When a Password-Based MAC is used, implementations must protect the
	password and the MAC key. Compromise of either the password or the		password and the MAC key. Compromise of either the password or the
	MAC key may result in the ability of an attacker to undermine		MAC key may result in the ability of an attacker to undermine
	authentication.		authentication.
	7. Acknowledgements		7. Acknowledgements
	Many thanks to Hans Aschauer, Hendrik Brockhaus, Quynh Dang, Roman		Many thanks to Hans Aschauer, Hendrik Brockhaus, Quynh Dang, Roman
	Danyliw, Tomas Gustavsson, Jonathan Hammell, Lijun Liao, Mike		Danyliw, Tomas Gustavsson, Jonathan Hammell, Tim Hollebeek, Lijun
	Ounsworth, Tim Polk, Mike StJohns, and Sean Turner for their careful		Liao, Mike Ounsworth, Tim Polk, Mike StJohns, and Sean Turner for
	review and improvements.		their careful review and improvements.
	8. References		8. References
	8.1. Normative References		8.1. Normative References
	[AES] National Institute of Standards and Technology, "Advanced		[AES] National Institute of Standards and Technology, "Advanced
	encryption standard (AES)", DOI 10.6028/nist.fips.197,		encryption standard (AES)", DOI 10.6028/nist.fips.197,
	November 2001, <https://doi.org/10.6028/nist.fips.197>.		November 2001, <https://doi.org/10.6028/nist.fips.197>.
	[GMAC] National Institute of Standards and Technology,		[GMAC] National Institute of Standards and Technology,
	"Recommendation for block cipher modes of operation:		"Recommendation for block cipher modes of operation:
	Galois Counter Mode (GCM) and GMAC",		Galois Counter Mode (GCM) and GMAC",
	DOI 10.6028/nist.sp.800-38d, 2007,		DOI 10.6028/nist.sp.800-38d, 2007,
	<https://doi.org/10.6028/nist.sp.800-38d>.		<https://doi.org/10.6028/nist.sp.800-38d>.
			[HMAC] Krawczyk, H., Bellare, M., and R. Canetti, "HMAC: Keyed-
			Hashing for Message Authentication", RFC 2104,
			DOI 10.17487/RFC2104, February 1997,
			<https://www.rfc-editor.org/rfc/rfc2104>.
	[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate		[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate
	Requirement Levels", BCP 14, RFC 2119,		Requirement Levels", BCP 14, RFC 2119,
	DOI 10.17487/RFC2119, March 1997,		DOI 10.17487/RFC2119, March 1997,
	<https://www.rfc-editor.org/info/rfc2119>.		<https://www.rfc-editor.org/info/rfc2119>.
	[RFC4211] Schaad, J., "Internet X.509 Public Key Infrastructure		[RFC4211] Schaad, J., "Internet X.509 Public Key Infrastructure
	Certificate Request Message Format (CRMF)", RFC 4211,		Certificate Request Message Format (CRMF)", RFC 4211,
	DOI 10.17487/RFC4211, September 2005,		DOI 10.17487/RFC4211, September 2005,
	<https://www.rfc-editor.org/info/rfc4211>.		<https://www.rfc-editor.org/info/rfc4211>.
	skipping to change at page 8, line 4 ¶		skipping to change at page 8, line 8 ¶
	<https://doi.org/10.6028/nist.sp.800-63b>.		<https://doi.org/10.6028/nist.sp.800-63b>.
	[DMR] Dell'Amico, M., Michiardi, P., and Y. Roudier, "Password		[DMR] Dell'Amico, M., Michiardi, P., and Y. Roudier, "Password
	Strength: An Empirical Analysis",		Strength: An Empirical Analysis",
	DOI 10.1109/INFCOM.2010.5461951, March 2010,		DOI 10.1109/INFCOM.2010.5461951, March 2010,
	<https://doi.org/10.1109/INFCOM.2010.5461951>.		<https://doi.org/10.1109/INFCOM.2010.5461951>.
	[I-D.ietf-lamps-cms-aes-gmac-alg]		[I-D.ietf-lamps-cms-aes-gmac-alg]
	Housley, R., "Using the AES-GMAC Algorithm with the		Housley, R., "Using the AES-GMAC Algorithm with the
	Cryptographic Message Syntax (CMS)", Work in Progress,		Cryptographic Message Syntax (CMS)", Work in Progress,
	Internet-Draft, draft-ietf-lamps-cms-aes-gmac-alg-03,		Internet-Draft, draft-ietf-lamps-cms-aes-gmac-alg-02, 30
	27 January 2020, <http://www.ietf.org/internet-drafts/		December 2020, <http://www.ietf.org/internet-drafts/draft-
	draft-ietf-lamps-cms-aes-gmac-alg-02.txt>.		ietf-lamps-cms-aes-gmac-alg-02.txt>.
	[PHS] Pathirana, A., Halgamuge, M., and A. Syed, "Energy		[PHS] Pathirana, A., Halgamuge, M., and A. Syed, "Energy
	efficient bitcoin mining to maximize the mining profit:		efficient bitcoin mining to maximize the mining profit:
	Using data from 119 bitcoin mining hardware setups",		Using data from 119 bitcoin mining hardware setups",
	International Conference on Advances in Business		International Conference on Advances in Business
	Management and Information Technology, pp 1-14, November		Management and Information Technology, pp 1-14, November
	2019.		2019.
			[PKCS11] RSA Laboratories, "The Public-Key Cryptography Standards -
			PKCS #11 v2.11: Cryptographic Token Interface Standard",
			June 2001.
	[RFC4231] Nystrom, M., "Identifiers and Test Vectors for HMAC-SHA-		[RFC4231] Nystrom, M., "Identifiers and Test Vectors for HMAC-SHA-
	224, HMAC-SHA-256, HMAC-SHA-384, and HMAC-SHA-512",		224, HMAC-SHA-256, HMAC-SHA-384, and HMAC-SHA-512",
	RFC 4231, DOI 10.17487/RFC4231, December 2005,		RFC 4231, DOI 10.17487/RFC4231, December 2005,
	<https://www.rfc-editor.org/info/rfc4231>.		<https://www.rfc-editor.org/info/rfc4231>.
	Author's Address		Author's Address
	Russ Housley		Russ Housley
	Vigil Security, LLC		Vigil Security, LLC
	516 Dranesville Road		516 Dranesville Road
End of changes. 11 change blocks.
	18 lines changed or deleted		28 lines changed or added
This html diff was produced by rfcdiff 1.48. The latest version is available from http://tools.ietf.org/tools/rfcdiff/