<html>
<head>
<meta content="text/html; charset=ISO-8859-1"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<div class="moz-cite-prefix">
Le 15/09/2014 17:08, Håvard Molland a écrit :<br>
</div>
<blockquote cite="mid:54170104.5040709@opera.com" type="cite">
<meta content="text/html; charset=ISO-8859-1"
http-equiv="Content-Type">
<div class="moz-cite-prefix">On 15. sep. 2014 15:51, Erwann Abalea
wrote:<br>
</div>
<blockquote cite="mid:5416EEE4.6060207@opentrust.com" type="cite">
<meta content="text/html; charset=ISO-8859-1"
http-equiv="Content-Type">
<div class="moz-cite-prefix"> Le 15/09/2014 13:16, Håvard
Molland a écrit :<br>
</div>
<blockquote cite="mid:5416CA8B.70403@opera.com" type="cite">
<meta content="text/html; charset=ISO-8859-1"
http-equiv="Content-Type">
<div class="moz-cite-prefix">On 15. sep. 2014 11:15, Erwann
Abalea wrote:<br>
</div>
<blockquote cite="mid:5416AE20.4070105@opentrust.com"
type="cite">
<meta content="text/html; charset=ISO-8859-1"
http-equiv="Content-Type">
<div class="moz-cite-prefix">[SM2/SM3 adoption]<br>
</div>
</blockquote>
<br>
Any new algorithm should offer improvements on the existing
algorithms, such as improved security, new security features
or speed. I'm not sure we should add new algorithms simply for
the sake of being alternatives.<br>
</blockquote>
<br>
I agree, that's what SHOULD drive the inclusion of algorithms or
parameters. Based on that, the CABF SHOULD NOT discuss about
approval of these new things (not yet) </blockquote>
<blockquote cite="mid:5416EEE4.6060207@opentrust.com" type="cite">
<br>
Others MAY think differently, such as Russia, where
GOST-approved algorithms are mandatory</blockquote>
You mean it's mandatory for servers to offer GOST? Surely they
can't demand browser support?<br>
</blockquote>
<br>
I mean it's mandatory for everyone to do GOST-* stuff. DNSSEC, TLS,
... You can think it's stupid (I do).<br>
Support for DNSSEC is present in RFC5933, support for TLS is drafted
in draft-chudov-cryptopro-cptls-04. There was some work on NSS, I
think OpenSSL works (with the GOST engine?), I don't know if
Opera/Apple/MS supports this.<br>
Mandatory is weak here; the .ru zone isn't GOST-* signed, I can't
find a GOST-* signed certificate, everyone seems to be happy with
the current situation.<br>
<br>
<blockquote cite="mid:54170104.5040709@opera.com" type="cite">
<blockquote cite="mid:5416EEE4.6060207@opentrust.com" type="cite">.
And we DO see GOST-approved hash algorithms used in OCSP
requests (to produce the issuerNameHash and issuerKeyHash). Now.<br>
</blockquote>
<blockquote cite="mid:5416EEE4.6060207@opentrust.com" type="cite">
<br>
What if China mandates the use of their own algorithms?<br>
</blockquote>
If every regime wants their own ciphers, it will be impossible to
manage. Instead of adding a new cipher suit per country/regime,
the list should consist of relatively few ciphers everyone could
agree on. Hopefully the current ciphers would be such a list,
although it might be a bit US centric. This discussion is a bit
to big for CA/B forum alone though.<br>
</blockquote>
<br>
China is a bigger market than Russia is. That could make a
difference. (insert sad face)<br>
Anyway, it's too early to discuss at CABF.<br>
<br>
<pre class="moz-signature" cols="72">--
Erwann ABALEA</pre>
<br>
</body>
</html>