| 1 |
On Wed, Jul 4, 2018 at 7:18 PM, Joshua Kinard <kumba@g.o> wrote: |
| 2 |
> On 7/4/2018 7:22 PM, Kristian Fiskerstrand wrote: |
| 3 |
>> On 07/05/2018 01:07 AM, Joshua Kinard wrote: |
| 4 |
>>>> @@ -64,6 +66,8 @@ not be used to commit. |
| 5 |
>>>> |
| 6 |
>>>> b. RSA, >=2048 bits (OpenPGP v4 key format or later only) |
| 7 |
>>>> |
| 8 |
>>>> + c. ECC, curve 25519 |
| 9 |
>>>> + |
| 10 |
>>>> 3. Key expiry: 5 years maximum |
| 11 |
>>>> |
| 12 |
>>>> 4. Upload your key to the SKS keyserver rotation before usage! |
| 13 |
>>>> |
| 14 |
>>> Add a minimum key size here for ECC. They have different bit sizes than |
| 15 |
>>> classic DSA/RSA keys. A quick read indicates that a 224-bit ECC key is roughly |
| 16 |
>>> equivalent to a 112-bit symmetric key, which is what a 2048-bit RSA key is |
| 17 |
>>> equivalent to, so the logical minimum for ECC looks like 'nistp256'. The |
| 18 |
>>> maximum is 521-bits on ECC (nistp521). |
| 19 |
>>> |
| 20 |
>>> Also move the mention of Ed25519 keys to their own bullet and clarify that they |
| 21 |
>>> don't allow for a key length, as I think that's hardcoded in some capacity. |
| 22 |
>> |
| 23 |
>> following the comma-style of the rest of the document, the ECC part |
| 24 |
>> should likely be read as curve25519 being the only acceptable curve, |
| 25 |
>> which is 256 bits (roughtly 128 bit shannon entropy equivalent) |
| 26 |
>> |
| 27 |
>> that said, I'm not aware of any curves defined with a lower security |
| 28 |
>> margin than this for OpenPGP in general. The known curves in the |
| 29 |
>> ecosystem are |
| 30 |
>> |
| 31 |
>> let oid_to_psize oid = |
| 32 |
>> let psize = match oid with |
| 33 |
>> | "\x2b\x81\x04\x00\x23" -> 521 (* nistp521 *) |
| 34 |
>> | "\x2b\x81\x04\x00\x22" -> 384 (* nistp384 *) |
| 35 |
>> | "\x2a\x86\x48\xce\x3d\x03\x01\x07" -> 256 (* nistp256 *) |
| 36 |
>> | "\x2b\x24\x03\x03\x02\x08\x01\x01\x07" -> 256 (* brainpoolP256r1 *) |
| 37 |
>> | "\x2b\x24\x03\x03\x02\x08\x01\x01\x0b" -> 384 (* brainpoolP384r1 *) |
| 38 |
>> | "\x2b\x24\x03\x03\x02\x08\x01\x01\x0d" -> 512 (* brainpoolP512r1 *) |
| 39 |
>> | "\x2b\x81\x04\x00\x0a" -> 256 (* secp256k1 *) |
| 40 |
>> | "\x2b\x06\x01\x04\x01\xda\x47\x0f\x01" -> 256 (* Ed25519 *) |
| 41 |
>> | _ -> failwith "Unknown OID" |
| 42 |
>> |
| 43 |
> |
| 44 |
> By "only acceptable curve", do you mean we shouldn't allow the nistp* key |
| 45 |
> types, only Ed25519? |
| 46 |
> |
| 47 |
|
| 48 |
Yes, the NIST curves are extremely suspect. I even have my doubts |
| 49 |
about Ed25519; I personally only use it where a device has throughput |
| 50 |
problems with RSA. |
| 51 |
|
| 52 |
Cheers, |
| 53 |
R0b0t1 |
Archives