Using SHA2 Algorithms with Cryptographic Message Syntax
updates
- rfc-3370 — Cryptographic Message Syntax (CMS) Algorithms
Extracted elements (21)
DSA with SHA-384 and SHA-512 are not defined because consistent cryptographic strength would require DSA with L=7680 for SHA-384 and L=15360 for SHA-512, both of which exceed DSA's maximum specified parameter size of L=3072.
Two valid encodings for SHA2 AlgorithmIdentifier parameters (NULL vs absent) exist because the OPTIONAL qualifier was lost when the 1988 AlgorithmIdentifier syntax was translated into 1997 syntax, then recovered via a defect report. By the time of recovery, many implementations were already encoding parameters as NULL, creating a persistent interoperability split.
PKCS#1 (RFC 3447) requires that RSA EMSA-PKCS1-v1_5 padding MUST use SHA2 AlgorithmIdentifiers with NULL parameters, creating an exception to the general rule that SHA2 AlgorithmIdentifiers MUST be generated with absent parameters. Implementations must handle both forms when accepting.
Implementations MUST accept SHA2 AlgorithmIdentifiers with absent parameters. Implementations MUST accept SHA2 AlgorithmIdentifiers with NULL parameters. Implementations MUST generate SHA2 AlgorithmIdentifiers with absent parameters.
When any of the four ECDSA-with-SHA2 OIDs appears within an AlgorithmIdentifier, the parameters field MUST be absent; the AlgorithmIdentifier SHALL be a SEQUENCE of one component (the OID only).
When any of the four RSA-with-SHA2 OIDs appears within an AlgorithmIdentifier, the parameters MUST be NULL. Implementations MUST also accept the parameters being absent.
When id-dsa-with-sha224 or id-dsa-with-sha256 appears as an AlgorithmIdentifier, the parameters field MUST be absent.
Digest algorithm identifiers for SHA2 are located in: SignedData digestAlgorithms field, SignerInfo digestAlgorithm field, DigestedData digestAlgorithm field, and AuthenticatedData digestAlgorithm field. Digest values appear in DigestedData digest field and the Message Digest authenticated attribute.
DSA MAY be used with SHA-224 (id-dsa-with-sha224) and SHA-256 (id-dsa-with-sha256) only. DSA is not specified with SHA-384 or SHA-512 because the maximum DSA modulus length p (L) is 3072 bits, which provides insufficient cryptographic strength to pair with those larger digests.
ECDSA MAY be used with SHA-224, SHA-256, SHA-384, or SHA-512 using OIDs ecdsa-with-SHA224 (ansi-X9-62 signatures 3 1), ecdsa-with-SHA256 (3 2), ecdsa-with-SHA384 (3 3), and ecdsa-with-SHA512 (3 4) from RFC 5758.
RSA (RSASSA-PKCS1-v1_5) MAY be used with SHA-224, SHA-256, SHA-384, or SHA-512 using OIDs sha224WithRSAEncryption (pkcs-1 14), sha256WithRSAEncryption (pkcs-1 11), sha384WithRSAEncryption (pkcs-1 12), and sha512WithRSAEncryption (pkcs-1 13).
SHA-224 algorithm identifier is id-sha224 OID { joint-iso-itu-t(2) country(16) us(840) organization(1) gov(101) csor(3) nistalgorithm(4) hashalgs(2) 4 }. Digest identifiers appear in SignedData digestAlgorithms, SignerInfo digestAlgorithm, DigestedData digestAlgorithm, and AuthenticatedData digestAlgorithm fields.
SHA-256 algorithm identifier is id-sha256 OID { joint-iso-itu-t(2) country(16) us(840) organization(1) gov(101) csor(3) nistalgorithm(4) hashalgs(2) 1 }. Parameters are absent or NULL per Section 2 conventions.
SHA-384 algorithm identifier is id-sha384 OID { joint-iso-itu-t(2) country(16) us(840) organization(1) gov(101) csor(3) nistalgorithm(4) hashalgs(2) 2 }. Parameters are absent or NULL per Section 2 conventions.
SHA-512 algorithm identifier is id-sha512 OID { joint-iso-itu-t(2) country(16) us(840) organization(1) gov(101) csor(3) nistalgorithm(4) hashalgs(2) 3 }. Parameters are absent or NULL per Section 2 conventions.
Signature algorithm identifiers are located in the SignerInfo signatureAlgorithm field of SignedData and also in the SignerInfo signatureAlgorithm field of countersignature attributes. Signature values are in the corresponding SignerInfo signature fields.
No new security considerations are introduced by this specification. The security considerations in RFC 3370, RFC 3874, RFC 4055, RFC 5753, and RFC 5758 all apply.
DER-encoded SMIMECapability values for DSA-with-SHA2: id-dsa-with-sha224 encodes as 30 0b 06 09 60 86 48 01 65 03 04 03 01; id-dsa-with-sha256 as 30 0b 06 09 60 86 48 01 65 03 04 03 02. Both use absent parameters.
DER-encoded SMIMECapability values for ECDSA-with-SHA2 (no parameters): ecdsa-with-SHA224 = 30 0a 06 08 2a 86 48 ce 3d 04 03 01; ecdsa-with-SHA256 = ...03 02; ecdsa-with-SHA384 = ...03 03; ecdsa-with-SHA512 = ...03 04.
DER-encoded SMIMECapability values for RSA-with-SHA2 (all include 05 00 NULL parameters): sha224WithRSAEncryption = 30 0d 06 09 2a 86 48 86 f7 0d 01 01 0e 05 00; sha256WithRSAEncryption = 30 0d ... 0b 05 00; sha384WithRSAEncryption = 30 0d ... 0c 05 00; sha512WithRSAEncryption = 30 0d ... 0d 05 00.
DER-encoded SMIMECapability values for SHA2 digests: id-sha224 encodes as 30 0b 06 09 60 86 48 01 65 03 04 02 04; id-sha256 as 30 0b 06 09 60 86 48 01 65 03 04 02 01; id-sha384 as 30 0b 06 09 60 86 48 01 65 03 04 02 02; id-sha512 as 30 0b 06 09 60 86 48 01 65 03 04 02 03. All use absent parameters.