Minutes of the February 6th 2024 Meeting

[johngray-dev]

Present at meeting: Julian Prat, Markku-Juhani O.Saarinen , John Gray, Mike Ounsworth, Alison Becker, Brendan Zember, Carl Wallace, Daniel Van Geest

• John discussed an overview of the latest virtual hackathon that happened on January 27th. See Summary of January 27th Virtual Interim Hackathon #93
• Brief discussion on CNSA 2.0. The preferred algorithms are ML-KEM Level 5 and P-384. See tables at the end of the CNSA 2.0 guidance.
• Daniel presented a proposal for artifact naming for KEM algorithms. He did some interoperability testing with Carl Wallace using the https://datatracker.ietf.org/doc/draft-ietf-lamps-cms-kemri/ draft.
  • TODO add the proposal from Dan once he send the information
  • Daniel mentioned he also made the interoperability results table "less terrible". See https://ietf-hackathon.github.io/pqc-certificates/pqc_hackathon_results_certs_r3.html
• Carl mentioned that Russ Housley had asked him it he would do an RSA KEM implementation. Daniel is not planning to do RSA KEM as he would basically have to implement it himself and then put it into https://datatracker.ietf.org/doc/draft-ietf-lamps-cms-kemri/
• John's implementation of https://datatracker.ietf.org/doc/draft-ietf-lamps-cms-kemri/ is not far enough along yet to produce artifacts.
• Question came up about why we support both the DER format and the PEM format for artifacts. The PEM format introduces errors, and DER encoding is what is needed. The version 1 draft of the KEMRecipientInfo zip format will only include DER format.
  • The next time we do an OID and Version update, we will remove support for PEM format. There was no objection to this: see Remove support for PEM format #95
• John mentioned that we should also add textual references instead of just OID string values in the names for easier understanding of which artifacts are being used. Most of us don't have all the prototype OIDS memorized! Tracked under: Add text description of OID in artifact names. #96
• Mike brought up the lamps CMS kyber draft - it needs a new version that aligns with https://datatracker.ietf.org/doc/draft-ietf-lamps-cms-kemri/
  • Daniel, Mike and Julian are going to update that draft
• Mike brought up the proposed changes he has made to composite KEM, asked the group about alignment with X-wing. He is going to post on the mailing list whether this is the correct way forward.
• Markku mentioned that using HKDF with SHA3 is not a good idea. Mike mentioned he should bring this up on the LAMPS mailing list as Russ has a draft that is getting close to Working Group Last Call. https://datatracker.ietf.org/doc/html/draft-ietf-lamps-cms-sha3-hash-00
• Brendan mention that are working on the related certificates draft https://datatracker.ietf.org/doc/draft-ietf-lamps-cert-binding-for-multi-auth/01/ and will be posting artifacts to the repository when ready.
• Daniel mentioned that the Ml-KEM-512-ipd OIDS defined in the OID mapping table and implemented by bouncy castle and LibOQS are not actually the NIST IPD version. It looks like we need an IPD version. For example, we have these:
  • | ML-KEM-512-ipd | 1.3.6.1.4.1.22554.5.6.1 | FIPS 203 (Initial Public Draft) |
  • | ML-KEM-768-ipd | 1.3.6.1.4.1.22554.5.6.2 | FIPS 203 (Initial Public Draft) |
  • | ML-KEM-1024-ipd | 1.3.6.1.4.1.22554.5.6.3 | FIPS 203 (Initial Public Draft) |
  • John will follow up with David Hook. Looks like we will need to assign new prototype OIDs.
• John mentioned he reached out to Paul Hoffman about setting up an e-mail address for this project. Something like [email protected] would be ideal.

[ralienpp]

A remark about RSA-KEM: a colleague of mine implemented it in OpenSSL, it should be available in the latest development branch. We also implemented it here, in Java: https://github.com/siemens/cmp-ra-component

Both implementations were tested against each other.