Hi,
we recently ran into one interoperability problem that is concerned
with RFC 7427.
We start testing RSASSA-PSS with another vendor product and found,
that while it supports Digital Signature authentication method, it seems
to not support RSASSA-PSS signatures in IKE. As a result, the SA
is
[This is bit old email, but I have not seen any replies to this, and I
am sending this as implementor not as chair.]
Valery Smyslov writes:
> The problem is that RFC7427 doesn't provide any means to find out
> what kind of signatures peer supports. If you have RSA certificate,
> you need somehow t
Hi Tero,
[This is bit old email, but I have not seen any replies to this, and I
am sending this as implementor not as chair.]
Valery Smyslov writes:
The problem is that RFC7427 doesn't provide any means to find out
what kind of signatures peer supports. If you have RSA certificate,
you need so
> On 4 Oct 2016, at 17:11, Valery Smyslov wrote:
>
> Hi Tero,
>> [This is bit old email, but I have not seen any replies to this, and I
>> am sending this as implementor not as chair.]
>> Valery Smyslov writes:
>>> The problem is that RFC7427 doesn't provide any means to find out
>>> what kind
Hi Yoav,
No this was different issue. I remember that discussion very well (since
I initiated it) and I wouldn't start it over again.
The issue we came across is not about different algorithms
(say indicating whether we need to use RSA or ECDSA if we have
both certificates). The algorithm is ess
On Tue, 4 Oct 2016, Valery Smyslov wrote:
I don't think negotiation is needed. It's enough if each side announces its
capabilities,
the same way it is done in RFC7427 with hash functions. And the easiest way
to do
it is to add pseudo-hash value "RSASSA-PSS supported" into the hash
algorithms r
Hi Paul,
I don't think negotiation is needed. It's enough if each side announces its
capabilities,
the same way it is done in RFC7427 with hash functions. And the easiest way
to do
it is to add pseudo-hash value "RSASSA-PSS supported" into the hash
algorithms registry.
In this case each side w
Perhaps we (as in the working group) should schedule some time (15-20 minutes?)
to discuss the options in Seoul.
Understanding both RFC 7427 and PSS signatures when they are in certificates,
but not PSS signatures when they are in AUTH payloads is a pretty egregious
kind of wrongness, but if th
Sure. I can prepare the slides (if the WG chairs don't mind).
Regards,
Valery.
Perhaps we (as in the working group) should schedule some time (15-20 minutes?)
to discuss the options in Seoul.
Understanding both RFC 7427 and PSS signatures when they are in certificates,
but not PSS signatures
Paul Wouters writes:
> I'm really against this solution. As you said, we can expect more of
> this with ECC variants, and it will just be a large cluttering of the
> integ registry.
Do you really think we will see this more in ECC? How will that happen
more in the ECC?
If I have Ed25519 key, why
Do you really think we will see this more in ECC? How will that happen
more in the ECC?
If I have Ed25519 key, why would someone go against the "SHOULD NOT"
in draft-nir-ipsecme-eddsa draft and use something else than Ed25519,
i.e., why would someone use Ed25519ph, or why would someone use ECDSA
That is fine. We can give 15 minutes on the agenda for this.
Thanks,
Dave
On: 05 October 2016 03:27, "Valery Smyslov" wrote:
Sure. I can prepare the slides (if the WG chairs don't mind).
Regards,
Valery.
> Perhaps we (as in the working group) should schedule some time (15-20
> minutes?) to d
Valery Smyslov writes:
> The reasons can be various. For example, after wide adoption
> of EdDSA some vulnerability is found in the scheme and some
> modifications are introduced to eliminate it (analogously to
If there would be vulnerability in the signature scheme, I think we
would say you MUS
The reasons can be various. For example, after wide adoption
of EdDSA some vulnerability is found in the scheme and some
modifications are introduced to eliminate it (analogously to
If there would be vulnerability in the signature scheme, I think we
would say you MUST NOT use the old format
14 matches
Mail list logo
