[prev in list] [next in list] [prev in thread] [next in thread] 

List:       cfrg
Subject:    Re: [Cfrg] BCP on crypto algorithms?
From:       "Paterson, Kenny" <Kenny.Paterson () rhul ! ac ! uk>
Date:       2016-03-30 11:55:24
Message-ID: D32179F8.68714%kenny.paterson () rhul ! ac ! uk
[Download RAW message or body]

Dear Hal,

Peter is correct in his assessment - your question is probably a bit broad.

These ENISA reports on algorithms and protocols might help you get started
though:

https://www.enisa.europa.eu/activities/identity-and-trust/library/deliverab
les/study-on-cryptographic-protocols

https://www.enisa.europa.eu/activities/identity-and-trust/library/deliverab
les/algorithms-key-size-and-parameters-report-2014


Although published in 2014, the two documents remain fairly up-to-date in
most aspects. Unfortunately, I don't think they're being updated any
longer.

Cheers

Kenny


On 30/03/2016 12:20, "Cfrg on behalf of Peter Gutmann"
<cfrg-bounces@irtf.org on behalf of pgut001@cs.auckland.ac.nz> wrote:

>Hal Murray <hmurray@megapathdsl.net> writes:
>
>>I'm looking for something like a Best Current Practices (BCP) document
>>that
>>covers crypto.  A non-RFC source is OK as long as it's generally trusted.
>>Preferably a source that is stable and updated occasionally.  Does such a
>>document exist?
>
>Yes and no.  While there's general agreement on what crypto you shouldn't
>use
>(single DES, ECB mode, MD5, etc), when it comes to what crypto to use you
>end
>up in a twisty maze of personal opinions, all different.  Ask ten crypto
>people and you'll get fifteen different opinions on what might constitute
>BCP.
>I don't know of any obvious solution to this problem, you could perhaps
>find
>something from a source that's acceptable to your target audience and
>declare
>that to be BCP.
>
>>The context is NTP (Network Time Protocol).  It currently has a simple
>>shared
>>key authentication mechanism that uses MD5 or SHA1.  It's probably time
>>to
>>update that.  What should we use?
>
>You're going to need to constrain things much, much more than that if you
>want
>a useful answer.  The above is sort of like going to an architect and
>saying
>"we want a building, we have infinite funding and time available, be
>creative".
>
>Peter.
>_______________________________________________
>Cfrg mailing list
>Cfrg@irtf.org
>https://www.irtf.org/mailman/listinfo/cfrg

_______________________________________________
Cfrg mailing list
Cfrg@irtf.org
https://www.irtf.org/mailman/listinfo/cfrg
[prev in list] [next in list] [prev in thread] [next in thread]