<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 14 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:新細明體;
panose-1:2 2 5 0 0 0 0 0 0 0;}
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:"\@新細明體";
panose-1:2 2 5 0 0 0 0 0 0 0;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Calibri","sans-serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p.MsoPlainText, li.MsoPlainText, div.MsoPlainText
{mso-style-priority:99;
mso-style-link:"純文字 字元";
margin:0cm;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Calibri","sans-serif";}
span.a
{mso-style-name:"純文字 字元";
mso-style-priority:99;
mso-style-link:純文字;
font-family:"Calibri","sans-serif";}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri","sans-serif";}
/* Page Definitions */
@page WordSection1
{size:612.0pt 792.0pt;
margin:72.0pt 113.7pt 72.0pt 113.7pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="ZH-TW" link="blue" vlink="purple" style="text-justify-trim:punctuation">
<div class="WordSection1">
<p class="MsoPlainText"><span lang="EN-US">> -----Original Message-----</span></p>
<p class="MsoPlainText"><span lang="EN-US">> From: public-bounces@cabforum.org [mailto:public-bounces@cabforum.org]</span></p>
<p class="MsoPlainText"><span lang="EN-US">> On Behalf Of Geoff Keating</span></p>
<p class="MsoPlainText"><span lang="EN-US">> Sent: Thursday, February 25, 2016 5:16 AM</span></p>
<p class="MsoPlainText"><span lang="EN-US">> To: Jeremy Rowley</span></p>
<p class="MsoPlainText"><span lang="EN-US">> Cc: public@cabforum.org</span></p>
<p class="MsoPlainText"><span lang="EN-US">> Subject: Re: [cabfpub] RFC5280</span></p>
<p class="MsoPlainText"><span lang="EN-US">> </span></p>
<p class="MsoPlainText"><span lang="EN-US">> </span></p>
<p class="MsoPlainText"><span lang="EN-US">> > On 24 Feb 2016, at 1:08 PM, Jeremy Rowley <<a href="mailto:jeremy.rowley@digicert.com"><span style="color:windowtext;text-decoration:none">jeremy.rowley@digicert.com</span></a>></span></p>
<p class="MsoPlainText"><span lang="EN-US">> wrote:</span></p>
<p class="MsoPlainText"><span lang="EN-US">> ></span></p>
<p class="MsoPlainText"><span lang="EN-US">> ></span></p>
<p class="MsoPlainText"><span lang="EN-US">> > It is not clear to me in what way 2047 == 2048 and why the same logic can</span><span lang="EN-US" style="font-family:"Courier New"">’</span><span lang="EN-US">t</span></p>
<p class="MsoPlainText"><span lang="EN-US">> be applied repeatedly to say that 1024 == 2048.</span></p>
<p class="MsoPlainText"><span lang="EN-US">> ></span></p>
<p class="MsoPlainText"><span lang="EN-US">> > [JR] See Peter Bowen's email for the explanation:</span></p>
<p class="MsoPlainText"><span lang="EN-US">> > " I think there is a misunderstanding here. There has never been a</span></p>
<p class="MsoPlainText"><span lang="EN-US">> requirement that the modulus contain a certain number of bits set to
</span><span lang="EN-US" style="font-family:"Courier New"">‘</span><span lang="EN-US">1</span><span lang="EN-US" style="font-family:"Courier New"">’</span><span lang="EN-US">.</span></p>
<p class="MsoPlainText"><span lang="EN-US">> What is required is that the modulus be a 2048-bit number. The problem is</span></p>
<p class="MsoPlainText"><span lang="EN-US">> that a 2048-bit number can have one or more of the high order bits being zero.</span></p>
<p class="MsoPlainText"><span lang="EN-US">> When calculating the modulus </span>
<span lang="EN-US" style="font-family:"Courier New"">“</span><span lang="EN-US">size</span><span lang="EN-US" style="font-family:"Courier New"">”</span><span lang="EN-US">, all an observer can do find the</span></p>
<p class="MsoPlainText"><span lang="EN-US">> left-most bit set to </span><span lang="EN-US" style="font-family:"Courier New"">‘</span><span lang="EN-US">1</span><span lang="EN-US" style="font-family:"Courier New"">’</span><span lang="EN-US"> and use that.
RSA moduli normally are the product</span></p>
<p class="MsoPlainText"><span lang="EN-US">> of two prime numbers. OpenSSL and some other generating tools have a</span></p>
<p class="MsoPlainText"><span lang="EN-US">> function that makes the top bit of each prime number to be 1 which ensures</span></p>
<p class="MsoPlainText"><span lang="EN-US">> the result will have the top bit set to 1. However a random prime could be</span></p>
<p class="MsoPlainText"><span lang="EN-US">> smaller, resulting in a smaller results.</span><span lang="EN-US" style="font-family:"Courier New"">”</span></p>
<p class="MsoPlainText"><span lang="EN-US">> </span></p>
<p class="MsoPlainText"><span lang="EN-US">> I think this is incorrect. A 2048-bit number is a number between 2^2047 and</span></p>
<p class="MsoPlainText"><span lang="EN-US">> 2^2048-1.</span></p>
<p class="MsoPlainText"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoPlainText"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoPlainText"><span lang="EN-US">I think the 2047-bit/2048-bit issue is related to the ASN.1 DER Encoding of Integer.<o:p></o:p></span></p>
<p class="MsoPlainText"><span lang="EN-US">ASN.1 DER uses "two's complement representation" for encoding integer values. In<o:p></o:p></span></p>
<p class="MsoPlainText"><span lang="EN-US">two's complement representation, the first bit (the most significant bit) determines<o:p></o:p></span></p>
<p class="MsoPlainText"><span lang="EN-US">whether a number is positive or negative. This means that sometimes an extra leading<o:p></o:p></span></p>
<p class="MsoPlainText"><span lang="EN-US">zero byte needs to be added to prevent the first bit from causing the integer to be<o:p></o:p></span></p>
<p class="MsoPlainText"><span lang="EN-US">interpreted as a negative number. Since the RSA modulus must be a positive integer, its<o:p></o:p></span></p>
<p class="MsoPlainText"><span lang="EN-US">the most significant bit in ASN.1 DER encoding must not be 1. That means if you want<o:p></o:p></span></p>
<p class="MsoPlainText"><span lang="EN-US">to generate a RSA modulus with its effective number of bits be 2048 (that is the first bit<o:p></o:p></span></p>
<p class="MsoPlainText"><span lang="EN-US">of the <span style="color:black">first byte is 1), an extra leading zero byte (00) needs to be added in its ASN.1 DER</span><o:p></o:p></span></p>
<p class="MsoPlainText"><span lang="EN-US" style="color:black">encoding, this will make the number of "bytes" of its ASN.1 encoding be 257 rather than<o:p></o:p></span></p>
<p class="MsoPlainText"><span lang="EN-US" style="color:black">256. I believe that most up-to-dated implementation of RSA key generators will strictly<o:p></o:p></span></p>
<p class="MsoPlainText"><span lang="EN-US" style="color:black">generate modulus with exact number of effective bits specified by the user. That is, if<o:p></o:p></span></p>
<p class="MsoPlainText"><span lang="EN-US" style="color:black">the user request the RSA key generator to generate a 2048-bit RSA key, the modulus<o:p></o:p></span></p>
<p class="MsoPlainText"><span lang="EN-US" style="color:black">generated will be a 256-byte octet string with first bit of the first byte being 1, and thus<o:p></o:p></span></p>
<p class="MsoPlainText"><span lang="EN-US" style="color:black">an extra leading zero byte (00) will be added in its ASN.1 DER encoding, which means<o:p></o:p></span></p>
<p class="MsoPlainText"><span lang="EN-US" style="color:black">the length of its ASN.1 DER encoding should be always 257 bytes.<o:p></o:p></span></p>
<p class="MsoPlainText"><span lang="EN-US" style="color:black"><o:p> </o:p></span></p>
<p class="MsoPlainText"><span lang="EN-US" style="color:black">The following is an example of the ASN.1 DER encoding of the value of a 2048-bit RSA<o:p></o:p></span></p>
<p class="MsoPlainText"><span lang="EN-US" style="color:black">modulus, please note the extra leading zero byte (00).<o:p></o:p></span></p>
<p class="MsoPlainText"><span lang="EN-US" style="color:black"><o:p> </o:p></span></p>
<p class="MsoPlainText"><span lang="EN-US" style="font-family:"Courier New";color:black">00 C9 F6 E7 34 E7 73 FE C6 66 92 06 E4 26 15 E6<o:p></o:p></span></p>
<p class="MsoPlainText"><span lang="EN-US" style="font-family:"Courier New";color:black">65 CC AF 90 44 04 AB AE C3 3D 84 B7 75 AA 8D E7<o:p></o:p></span></p>
<p class="MsoPlainText"><span lang="EN-US" style="font-family:"Courier New";color:black">41 DB 28 17 CF CB D9 2A F6 DC B1 69 7C 5D E6 5D<o:p></o:p></span></p>
<p class="MsoPlainText"><span lang="EN-US" style="font-family:"Courier New";color:black">FF DD 79 B5 89 70 38 A2 2A A2 45 C6 6B FA EA FC<o:p></o:p></span></p>
<p class="MsoPlainText"><span lang="EN-US" style="font-family:"Courier New";color:black">3A CD 39 A2 FD 36 AE 18 A7 E4 FF C4 A6 6B 7D 9F<o:p></o:p></span></p>
<p class="MsoPlainText"><span lang="EN-US" style="font-family:"Courier New";color:black">19 C3 AF FC 4C 67 1D 50 5E 86 49 43 8B B0 CC 2D<o:p></o:p></span></p>
<p class="MsoPlainText"><span lang="EN-US" style="font-family:"Courier New";color:black">59 62 3E 58 90 89 1A A2 62 E4 DB 17 F3 80 98 CB<o:p></o:p></span></p>
<p class="MsoPlainText"><span lang="EN-US" style="font-family:"Courier New";color:black">0C CC F2 5A 7E DC 7E 37 90 2A 12 A9 4D 78 B1 46<o:p></o:p></span></p>
<p class="MsoPlainText"><span lang="EN-US" style="font-family:"Courier New";color:black">AE BF C8 5A DC EC 0A 5C 2B A5 0C A6 60 81 CE 0F<o:p></o:p></span></p>
<p class="MsoPlainText"><span lang="EN-US" style="font-family:"Courier New";color:black">32 4A 2A DD 7B 23 D7 44 9A 06 CA 1C F4 C1 88 A6<o:p></o:p></span></p>
<p class="MsoPlainText"><span lang="EN-US" style="font-family:"Courier New";color:black">62 6B C7 0B 6B DE 9C 51 95 BD C8 AF 2A 8C 9F DC<o:p></o:p></span></p>
<p class="MsoPlainText"><span lang="EN-US" style="font-family:"Courier New";color:black">99 4F 35 28 94 A9 EF A0 FD 04 0D 0A 4A 71 FA DF<o:p></o:p></span></p>
<p class="MsoPlainText"><span lang="EN-US" style="font-family:"Courier New";color:black">A4 C5 D1 CC D5 BB B0 1E A7 00 A4 C7 D4 C4 FE E5<o:p></o:p></span></p>
<p class="MsoPlainText"><span lang="EN-US" style="font-family:"Courier New";color:black">10 D8 C5 69 10 E7 90 EF 65 95 57 3C 0B A2 A9 42<o:p></o:p></span></p>
<p class="MsoPlainText"><span lang="EN-US" style="font-family:"Courier New";color:black">A1 87 65 07 9E A2 E1 34 C0 D8 D6 6D 0E 63 85 D2<o:p></o:p></span></p>
<p class="MsoPlainText"><span lang="EN-US" style="font-family:"Courier New";color:black">03 87 9F ED 65 AA E0 BA 93 31 6A 0D F2 4F 25 17<o:p></o:p></span></p>
<p class="MsoPlainText"><span lang="EN-US" style="font-family:"Courier New";color:black">FC<o:p></o:p></span></p>
<p class="MsoPlainText"><span lang="EN-US" style="color:black"><o:p> </o:p></span></p>
<p class="MsoPlainText"><span lang="EN-US" style="color:black">However, there might exists some implementations which might not generate<o:p></o:p></span></p>
<p class="MsoPlainText"><span lang="EN-US" style="color:black">exact number of bits specified by the user. For example, if an implementation<o:p></o:p></span></p>
<p class="MsoPlainText"><span lang="EN-US" style="color:black">generates a 256-byte with the first bit of the first byte is 0. In such a situation, the<o:p></o:p></span></p>
<p class="MsoPlainText"><span lang="EN-US" style="color:black">effective number of bits is actually 2047 but it is perfectly be a positive integer in<o:p></o:p></span></p>
<p class="MsoPlainText"><span lang="EN-US" style="color:black">the ASN.1 DER Encoding and thus no extra leading zero byte (00) is needed.<o:p></o:p></span></p>
<p class="MsoPlainText"><span lang="EN-US" style="color:black">Will we accept this kind of 2047-bit RSA modulus? Or even accepting the range<o:p></o:p></span></p>
<p class="MsoPlainText"><span lang="EN-US" style="color:black">of 2041-bit to 2047-bit modulus? (because the leading first to seventh bits might<o:p></o:p></span></p>
<p class="MsoPlainText"><span lang="EN-US" style="color:black">be 0)<o:p></o:p></span></p>
<p class="MsoPlainText"><span lang="EN-US" style="color:black"><o:p> </o:p></span></p>
<p class="MsoPlainText"><span lang="EN-US" style="color:black">Currently, our CA implementation will reject 2047-bit modulus and our<o:p></o:p></span></p>
<p class="MsoPlainText"><span lang="EN-US" style="color:black">implementation of key generator will always generate keys with exact number<o:p></o:p></span></p>
<p class="MsoPlainText"><span lang="EN-US" style="color:black">of effective bits specified by the user. However, I do not think allowing only a<o:p></o:p></span></p>
<p class="MsoPlainText"><span lang="EN-US" style="color:black">few leading zero bits in keys will endanger the security. Personally, I am neutral<o:p></o:p></span></p>
<p class="MsoPlainText"><span lang="EN-US" style="color:black">to this 2047-bit/2048-bit issue. If the final decision is that the key should be exactly<o:p></o:p></span></p>
<p class="MsoPlainText"><span lang="EN-US" style="color:black">2048 bits, that will be fine for me. If the final decision will allow a little relax about<o:p></o:p></span></p>
<p class="MsoPlainText"><span lang="EN-US" style="color:black">the exact effective bits, that will be also fine for me.<o:p></o:p></span></p>
<p class="MsoPlainText"><span lang="EN-US" style="color:black"><o:p> </o:p></span></p>
<p class="MsoPlainText"><span lang="EN-US" style="color:black">Wen-Cheng Wang<o:p></o:p></span></p>
</div>
<B><BR><BR><font size="-1">本信件可能包含中華電信股份有限公司機密資訊,非指定之收件者,請勿蒐集、處理或利用本信件內容,並請銷毀此信件.
如為指定收件者,應確實保護郵件中本公司之營業機密及個人資料,不得任意傳佈或揭露,並應自行確認本郵件之附檔與超連結之安全性,以共同善盡資訊安全與個資保護責任.
<BR>Please be advised that this email message (including any attachments) contains confidential information and may be legally privileged. If you are not the intended recipient, please destroy this message and all attachments from your system and do not further collect, process, or use them. Chunghwa Telecom and all its subsidiaries and associated companies shall not be liable for the improper or incomplete transmission of the information contained in this email nor for any delay in its receipt or damage to your system. If you are the intended recipient, please protect the confidential and/or personal information contained in this email with due care. Any unauthorized use, disclosure or distribution of this message in whole or in part is strictly prohibited. Also, please self-inspect attachments and hyperlinks contained in this email to ensure the information security and to protect personal information.</font></B>
</body>
</html>