Re: [IPsec] Bikeshedding the RFC 4307bis Algorithms - side meeting

Reminder. It’s tonight at 7:00 PM Japan time, 10:00 UTC. We won’t have Meetecho or audio streaming, but if a few remote people want to participate, we might be able to do something with Skype. Yoav > On 2 Nov 2015, at 10:28 AM, Yoav Nir wrote: > > Hi, all > > Since

Re: [IPsec] Bikeshedding the RFC 4307bis Algorithms - side meeting

> On 3 Nov 2015, at 1:33 PM, Tero Kivinen wrote: > > Yoav Nir writes: >> There is 1 for “RSA Digital Signature” and you can encode any hash >> function the you would like, but for ECDSA there is: >> 9 - ECDSA with SHA-256 on the P-256 curve >> 10 - ECDSA with SHA-384 on the

Re: [IPsec] Bikeshedding the RFC 4307bis Algorithms - side meeting

On Mon, November 2, 2015 8:58 pm, Yoav Nir wrote: > >> On 3 Nov 2015, at 1:33 PM, Tero Kivinen wrote: >> >> Yoav Nir writes: >>> There is 1 for “RSA Digital Signature” and you can encode any hash >>> function the you would like, but for ECDSA there is: >>> 9 - ECDSA with

Re: [IPsec] Bikeshedding the RFC 4307bis Algorithms - side meeting

> On 2 Nov 2015, at 6:32 PM, Yaron Sheffer wrote: > > If not here, where does this advice go? I see your point. But for instance for X509 certificates, I really would like to not make any statement and point to whatever equivalent of PKIX

Re: [IPsec] Bikeshedding the RFC 4307bis Algorithms - side meeting

If not here, where does this advice go? I see your point. But for instance for X509 certificates, I really would like to not make any statement and point to whatever equivalent of PKIX documents there are on that. Does the TLS WG have any documents on crypto agility for PKIX? The TLS list

Re: [IPsec] Bikeshedding the RFC 4307bis Algorithms - side meeting

On Sun, November 1, 2015 7:21 pm, Yoav Nir wrote: > >> On 2 Nov 2015, at 11:44 AM, Paul Wouters wrote: >> >> On Mon, 2 Nov 2015, Yoav Nir wrote: >> >>> P.S. Someone’s asked me off-list whether there is any IPsecME >>> document that says not to trust SHA-1 in signatures, both

Re: [IPsec] Bikeshedding the RFC 4307bis Algorithms - side meeting

Yoav Nir writes: > There is 1 for “RSA Digital Signature” and you can encode any hash > function the you would like, but for ECDSA there is: > 9 - ECDSA with SHA-256 on the P-256 curve > 10 - ECDSA with SHA-384 on the P-384 curve > 11 - ECDSA with SHA-512 on the P-521 curve Also number 3 DSS

Re: [IPsec] Bikeshedding the RFC 4307bis Algorithms - side meeting

> On 3 Nov 2015, at 10:48 AM, Dan Harkins wrote: > > > > On Sun, November 1, 2015 7:21 pm, Yoav Nir wrote: >> >>> On 2 Nov 2015, at 11:44 AM, Paul Wouters wrote: >>> >>> On Mon, 2 Nov 2015, Yoav Nir wrote: >>> P.S. Someone’s asked me off-list

Re: [IPsec] Bikeshedding the RFC 4307bis Algorithms - side meeting

On Mon, 2 Nov 2015, Yoav Nir wrote: P.S. Someone’s asked me off-list whether there is any IPsecME document that says not to trust SHA-1 in signatures, both AUTH payload and certificates, the way the TLS 1.3 document may end up saying for TLS. I’m wondering if RFC4307bis might be the place

Re: [IPsec] Bikeshedding the RFC 4307bis Algorithms - side meeting

On Mon, 2 Nov 2015, Yoav Nir wrote: P.S. Someone’s asked me off-list whether there is any IPsecME document that says not to trust SHA-1 in signatures, both AUTH payload and certificates, the way the TLS 1.3 document may end up saying for TLS. I’m wondering if RFC4307bis might be the place

Re: [IPsec] Bikeshedding the RFC 4307bis Algorithms - side meeting

Forgot the link… > On 2 Nov 2015, at 12:38 PM, Yoav Nir wrote: > > >> On 2 Nov 2015, at 12:27 PM, Paul Wouters wrote: >> >> On Mon, 2 Nov 2015, Yoav Nir wrote: >> > P.S. Someone’s asked me off-list whether there is any IPsecME document > that

[IPsec] Bikeshedding the RFC 4307bis Algorithms - side meeting

Hi, all Since we’ve had quite a bit of bikeshedding about this on the list, we’d like to gather and has it out face to face. So this Wednesday at 7:00 PM, right after the plenaries, we’ll meet at room 421 to hash this out. Everyone’s invited, obviously. Yoav P.S. Someone’s asked me off-list

Re: [IPsec] Bikeshedding the RFC 4307bis Algorithms - side meeting

> On 2 Nov 2015, at 11:44 AM, Paul Wouters wrote: > > On Mon, 2 Nov 2015, Yoav Nir wrote: > >> P.S. Someone’s asked me off-list whether there is any IPsecME document that >> says not to trust SHA-1 in signatures, both AUTH payload and certificates, >> the way the TLS 1.3

Re: [IPsec] Bikeshedding the RFC 4307bis Algorithms - side meeting

> On 2 Nov 2015, at 12:27 PM, Paul Wouters wrote: > > On Mon, 2 Nov 2015, Yoav Nir wrote: > P.S. Someone’s asked me off-list whether there is any IPsecME document that says not to trust SHA-1 in signatures, both AUTH payload and certificates, the way the TLS