Use of the SHAKE One-Way Hash Functions in the Cryptographic Message Syntax (CMS)
updates
- rfc-3370 — Cryptographic Message Syntax (CMS) Algorithms
Extracted elements (25)
A 4096-bit RSA modulus is recommended for SHAKE256 rather than the theoretically required 15360-bit modulus for 256-bit security because the latter is impractical with current technology; this is a deliberate trade-off between security levels and real-world deployability.
SHAKE128 and SHAKE256 are used natively as the MGF in RSASSA-PSS rather than via the MGF1 construction, exploiting SHAKE's extendable-output property to produce arbitrary-length output directly without iterating the hash function.
This specification does not use RSASSA-PSS-params (as defined in RFC 4055) because the hash algorithm, mask generation algorithm, trailer, and salt are embedded in the OID definition itself, simplifying the encoding by eliminating the parameters field.
SHAKE128 and SHAKE256 with 32- and 64-octet output lengths can be used in ECDSA as substitutes for 256- and 512-bit output hash algorithms (such as SHA256 and SHA512), though ANSI X9.62 and SEC1 have not formally specified SHAKE as hash algorithm options.
Conforming CA implementations that generate ECDSA with SHAKE signatures in certificates or CRLs SHOULD generate such signatures with a deterministically generated, nonrandom k in accordance with RFC 6979.
Conforming implementations MUST specify and process the algorithms explicitly by using the OIDs specified in Section 2 when encoding ECDSA with SHAKE public keys in CMS messages. The identifier parameters MUST be absent.
Conforming implementations that process KMACs with the SHAKEs when processing CMS data MUST recognize the id-KmacWithSHAKE128 and id-KmacWithSHAKE256 identifiers.
Conforming implementations that process RSASSA-PSS and ECDSA with SHAKE signatures when processing CMS data MUST recognize the corresponding OIDs specified in Section 2.
For ECDSA with SHAKE, the encoding MUST omit the parameters field. The output length for SHAKE128 or SHAKE256 used in ECDSA MUST be 32 or 64 bytes, respectively.
For RSASSA-PSS with SHAKE, the encoding MUST omit the parameters field. The hash algorithm used to hash the message and the mask generation function MUST both be the same SHAKE variant (both SHAKE128 or both SHAKE256).
In RSASSA-PSS with SHAKEs, the SHAKEs MUST be used natively as the mask generation function (MGF), instead of MGF1. The MGF output length is (8*emLen - 264) bits for SHAKE128 or (8*emLen - 520) bits for SHAKE256.
The OID encoding for SHAKE128 or SHAKE256 as a message digest MUST omit the parameters field, and the output length MUST be 32 bytes (SHAKE128) or 64 bytes (SHAKE256). The digest algorithm MUST be the same as the message hash algorithm used in signatures.
The parameters for id-RSASSA-PSS-SHAKE128, id-RSASSA-PSS-SHAKE256, id-ecdsa-with-shake128, and id-ecdsa-with-shake256 MUST be absent; each identifier SHALL be a SEQUENCE of one component (the OID).
The RSASSA-PSS saltLength MUST be 32 bytes for id-RSASSA-PSS-SHAKE128 or 64 bytes for id-RSASSA-PSS-SHAKE256. The trailerField MUST be 1 (hexadecimal value 0xBC).
When id-KmacWithSHAKE128 or id-KmacWithSHAKE256 is used as the MAC algorithm identifier, the parameters field is OPTIONAL. If absent, the SHAKE output length used in KMAC is 32 or 64 bytes respectively, and the customization string defaults to an empty string.
When the RSA private key owner wishes to limit the public key exclusively to RSASSA-PSS, the AlgorithmIdentifier for RSASSA-PSS defined in Section 2 SHOULD be used as the algorithm attribute in the OriginatorPublicKey sequence. Conforming client implementations that process RSASSA-PSS with SHAKE public keys MUST recognize the corresponding OIDs.
When using id-shake128 or id-shake256 algorithm identifiers, the parameters field MUST be absent; the AlgorithmIdentifier SHALL be a SEQUENCE of one component (the OID).
When using RSASSA-PSS or ECDSA with SHAKEs, the RSA modulus or ECDSA curve order SHOULD be chosen in line with the SHAKE output length, as detailed in the security considerations.
Eight OIDs are defined for use in CMS: id-shake128 (2.16.840.1.101.3.4.2.11), id-shake256 (2.16.840.1.101.3.4.2.12), id-RSASSA-PSS-SHAKE128 (pkix.algorithms.30), id-RSASSA-PSS-SHAKE256 (pkix.algorithms.31), id-ecdsa-with-shake128 (pkix.algorithms.32), id-ecdsa-with-shake256 (pkix.algorithms.33), id-KmacWithSHAKE128 (2.16.840.1.101.3.4.2.19), and id-KmacWithSHAKE256 (2.16.840.1.101.3.4.2.20).
KMAC (Keccak message authentication code) identifiers id-KmacWithSHAKE128 and id-KmacWithSHAKE256 are used in AuthenticatedData macAlgorithm field. The variable N is 0xD2B282C2, S is an empty string, and L is 256 or 512 bits for KmacWithSHAKE128 or KmacWithSHAKE256 respectively.
SHAKE128 and SHAKE256 are extendable-output functions (XOFs) used in CMS with fixed output lengths: d=256 bits (32 bytes) for SHAKE128 and d=512 bits (64 bytes) for SHAKE256. SHAKE128 provides min(d/2,128) collision resistance and min(d,128) second-preimage resistance; SHAKE256 provides min(d/2,256) and min(d,256) bits respectively.
One object identifier for the ASN.1 module was added to the 'Structure of Management Information (SMI) Security for S/MIME Module Identifier (1.2.840.113549.1.9.16.0)' registry: decimal 70, description 'CMSAlgsForSHAKE-2019', reference RFC 8702.
SHAKE128 with 32-byte output offers 128 bits of collision and preimage resistance; its OIDs are RECOMMENDED with 2048-bit (112-bit security) or 3072-bit (128-bit security) RSA moduli or 256-bit group order curves. SHAKE256 with 64-byte output offers 256 bits of resistance; its OIDs are RECOMMENDED with 4096-bit RSA or curves with at least 512-bit group order (e.g., NIST P-521).
When more than two parties share the same message-authentication key, data origin authentication is not provided. Any party that knows the key can compute a valid MAC, so content origin cannot be determined among sharing parties.
KMACwithSHAKE128-params is a SEQUENCE with kMACOutputLength (INTEGER, default 256 bits) and customizationString (OCTET STRING, default empty). KMACwithSHAKE256-params is identical but with kMACOutputLength defaulting to 512 bits.