Secure Crypto Config
draft-kaimindermann-securecryptoconfig-00

Document Type Active Internet-Draft (individual)
Authors Kai Mindermann  , Lisa Teis 
Last updated 2020-10-18
Stream (None)
Intended RFC status (None)
Formats plain text html xml pdf htmlized (tools) htmlized bibtex
Stream Stream state (No stream defined)
Consensus Boilerplate Unknown
RFC Editor Note (None)
IESG IESG state I-D Exists
Telechat date
Responsible AD (None)
Send notices to (None)
cfrg                                                       K. Mindermann
Internet-Draft                                           iC Consult GmbH
Intended status: Informational                                   L. Teis
Expires: 21 April 2021                                   18 October 2020

                          Secure Crypto Config
               draft-kaimindermann-securecryptoconfig-00

Abstract

   Choosing secure cryptography algorithms and their corresponding
   parameters is difficult.  Also, current cryptography APIs cannot
   change their default configuration which renders them inherently
   insecure.  The Secure Crypto Config provides a method that allows
   cryptography libraries to change the default cryptography algorithms
   over time and at the same time stay compatible with previous
   cryptography operations.  This is achieved by combining three things
   standardized by the Secure Crypto Config: (1) A process that is
   repeated every two years, where a new set of default configurations
   for standardized cryptography primitives is published in a specific
   format. (2) A Secure Crypto Config Interface that describes a common
   API to use cryptography primitives in software (3) using COSE to
   derive the parameters from output of cryptography primitives,
   otherwise future changes of the default configuration would change
   existing applications behavior.

Note to Readers

   Comments are solicited and should be addressed to the GitHub
   repository issue tracker (https://github.com/secureCryptoConfig/
   secureCryptoConfig) and/or the author(s)

Status of This Memo

   This Internet-Draft is submitted in full conformance with the
   provisions of BCP 78 and BCP 79.

   Internet-Drafts are working documents of the Internet Engineering
   Task Force (IETF).  Note that other groups may also distribute
   working documents as Internet-Drafts.  The list of current Internet-
   Drafts is at https://datatracker.ietf.org/drafts/current/.

   Internet-Drafts are draft documents valid for a maximum of six months
   and may be updated, replaced, or obsoleted by other documents at any
   time.  It is inappropriate to use Internet-Drafts as reference
   material or to cite them other than as "work in progress."

Mindermann & Teis         Expires 21 April 2021                 [Page 1]
Internet-Draft                     SCC                      October 2020

   This Internet-Draft will expire on 21 April 2021.

Copyright Notice

   Copyright (c) 2020 IETF Trust and the persons identified as the
   document authors.  All rights reserved.

   This document is subject to BCP 78 and the IETF Trust's Legal
   Provisions Relating to IETF Documents (https://trustee.ietf.org/
   license-info) in effect on the date of publication of this document.
   Please review these documents carefully, as they describe your rights
   and restrictions with respect to this document.  Code Components
   extracted from this document must include Simplified BSD License text
   as described in Section 4.e of the Trust Legal Provisions and are
   provided without warranty as described in the Simplified BSD License.

Table of Contents

   1.  Introduction  . . . . . . . . . . . . . . . . . . . . . . . .   3
     1.1.  Motivation  . . . . . . . . . . . . . . . . . . . . . . .   4
     1.2.  Terminology . . . . . . . . . . . . . . . . . . . . . . .   5
       1.2.1.  Conventions and Definitions . . . . . . . . . . . . .   5
       1.2.2.  Terms . . . . . . . . . . . . . . . . . . . . . . . .   5
     1.3.  Use Cases . . . . . . . . . . . . . . . . . . . . . . . .   5
       1.3.1.  Secure Crypto Config Use Cases  . . . . . . . . . . .   5
       1.3.2.  Cryptography Use Cases  . . . . . . . . . . . . . . .   6
   2.  Requirements and Assumptions  . . . . . . . . . . . . . . . .   9
     2.1.  Requirements  . . . . . . . . . . . . . . . . . . . . . .   9
     2.2.  Assumptions . . . . . . . . . . . . . . . . . . . . . . .  12
   3.  Security Levels . . . . . . . . . . . . . . . . . . . . . . .  12
     3.1.  Security Level 1 - Low  . . . . . . . . . . . . . . . . .  12
     3.2.  Security Level 2  . . . . . . . . . . . . . . . . . . . .  12
     3.3.  Security Level 3  . . . . . . . . . . . . . . . . . . . .  12
     3.4.  Security Level 4  . . . . . . . . . . . . . . . . . . . .  13
     3.5.  Security Level 5 - High . . . . . . . . . . . . . . . . .  13
     3.6.  Security Level Constraints  . . . . . . . . . . . . . . .  13
       3.6.1.  Information classification  . . . . . . . . . . . . .  13
       3.6.2.  Longevity . . . . . . . . . . . . . . . . . . . . . .  13
       3.6.3.  Constrained Devices . . . . . . . . . . . . . . . . .  14
       3.6.4.  n-Bit-Security  . . . . . . . . . . . . . . . . . . .  14
       3.6.5.  Attacker Resources and Capabilities . . . . . . . . .  14
   4.  Consensus Finding Process and entities  . . . . . . . . . . .  15
     4.1.  Consensus Finding . . . . . . . . . . . . . . . . . . . .  15
Show full document text