]>
Put Your Internet Draft Title
HereCisco Systemspkampana@cisco.comNIST100 Bureau Drive, Stop 8930GaithersburgMD20899-8930USAquynh.dang@nist.gov
General
LAMPS WGThis document describes the conventions for using the SHAKE family of
hash functions in the Internet X.509 PKI as one-way hash functions
with the RSA, DSA and ECDSA signature algorithms; the
conventions for the associated subject public keys are also
described. Digital signatures are used to sign messages,
certificates and CRLs (Certificate Revocation Lists).draft-kampanakis-adding-shake-to-pkix-00:
Initial versionEDNOTE: More here.This section describes several cryptographic algorithms which may be used
with the Internet X.509 Certificate and CRL profile . This
section describes two one-way hash functions and digital signature
algorithms using these functions, which may be used to sign certificates and
CRLs, and identifies OIDs (Object Identifiers) for public keys contained in
certificates.The SHA-3 family of one-way hash functions is specified in .
In the SHA-3 family, two extendable-output functions, called SHAKE128 and SHAKE256 are
defined. Four hash functions, SHA3-224, SHA3-256, SHA3-384, and SHA3-512 are also
defined but are out of scope for this document. The output lengths, in bits, of
the SHAKE hash functions is defined by the parameter d. The corresponding
collision and preimage resistance security levels for SHAKE128 and SHAKE256
are respectively min(d/2,128) and min(d,128) and min(d/2,256) and min(d,256).
The OIDs (Object Identifiers) for these two hash functions are as follows: The output length, d, is always 256 and 512 bits for SHAKE128 and
SHAKE256 respectively in this specification.EDNOTE: To be discussed by the WG about what RSA standard with SHAKE is to be covered by this draft. The DSA algorithm is defined in the Digital Signature Standard (DSS)
.
When SHAKE128 is used with DSA, the OID is: When SHAKE256 is used with DSA, the OID is:EDNOTE: "x" and "y" will be specified by NIST later. When the id-dsa-with-shake128 or id-dsa-with-shake256 algorithm
identifier appears in the algorithm field as an AlgorithmIdentifier,
the encoding SHALL omit the parameters field. That is, the
AlgorithmIdentifier SHALL be a SEQUENCE of one component, the OID
id-dsa-with-shake128 or id-dsa-with-shake256. Encoding rules for DSA signature values are specified in . Conforming CA implementations that generate DSA signatures for
certificates or CRLs MUST generate such DSA signatures in accordance
with all the requirements in Section 4 in . The lengths of
p and q must be at least 2048 and 224 bits respectively.The Elliptic Curve Digital Signature Algorithm (ECDSA) is defined in
"Public Key Cryptography for the Financial Services Industry: The
Elliptic Curve Digital Signature Standard (ECDSA)" .
The ASN.1 OIDs of ECDSA signature algorithms using SHAKE128 and SHAKE256,
are below: EDNOTE: "x" and "y" will be specified by NIST later. When the id-ecdsa-with-SHAKE128 or id-ecdsa-with-SHAKE256,
algorithm identifier appears in the algorithm field
as an AlgorithmIdentifier, the encoding MUST omit the parameters
field. That is, the AlgorithmIdentifier SHALL be a SEQUENCE of one
component, the OID ecdsa-with-SHAKE128 or ecdsa-with-SHAKE256.Conforming CA implementations MUST specify the hash algorithm
explicitly using the OIDs specified above when encoding ECDSA/SHAKE
signatures in certificates and CRLs.Conforming client implementations that process ECDSA signatures with
any of the SHAKE hash algorithms when processing certificates and CRLs
MUST recognize the corresponding OIDs specified above.Encoding rules for ECDSA signature values are specified in
, Section 2.2.3, and .Conforming CA implementations that generate ECDSA signatures in
certificates or CRLs MUST generate such ECDSA signatures in
accordance with all the requirements specified in Sections 7.2 and
7.3 of or with all the requirements specified in Section
4.1.3 of . They MAY also generate such ECDSA
signatures in accordance with all the recommendations in or
if they have a stated policy that requires
conformance to these standards. These standards above may have not specified
SHAKE128 and SHAKE256 as hash algorithm options. However, SHAKE128 and
SHAKE256 with output length being 256 and 512 bits respectively are
subtitutions for 256 and 512-bit output hash algorithms such as SHA256
and SHA512 used in the standards.EDNOTE: Depending on the updates to the Charter, the group may want to consider an EdDSA with SHAKE section here. The conventions for RSA, DSA and ECDSA public keys are as specified in
and . We include them here for convenience: EDNOTE: Add the public key OIDs here.We would like to thank Sean Turner for his valuable contributions to this document. IANA is kindly requested to register two OIDs in the SMI Security for
PKIX Module Identifier registry for the ASN.1 modules found in
. The description is as follows:
EDNOTE: More here
where the four digits at the end represent the ASN.1's publication
date.EDNOTE: More here.
&RFC3279;
&RFC5280;
&RFC5480;
SHA-3 Standard - Permutation-Based Hash and Extendable-Output Functions FIPS PUB 202National Institute of Standards and TechnologyDigital Signature Standard (DSS) FIPS PUB 186-4National Institute of Standards and TechnologySEC 1: Elliptic Curve CryptographyStandards for Efficient Cryptography GroupX9.62-2005 Public Key Cryptography for the Financial Services Industry: The Elliptic Curve Digital Signature Standard (ECDSA)American National Standard for Financial Services (ANSI)EDNOTE: More here.