From mboxrd@z Thu Jan 1 00:00:00 1970 From: Michael Tremer To: documentation@lists.ipfire.org Subject: Re: Cryptography Date: Sat, 08 Feb 2014 15:37:52 +0100 Message-ID: <1391870272.21794.154.camel@rice-oxley.tremer.info> In-Reply-To: <588CE637-2C6C-4F5B-9208-811574F2E5D8@ipfire.org> MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="===============0946661049654835723==" List-Id: --===============0946661049654835723== Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Hi, On Fri, 2014-02-07 at 11:58 +0100, ummeegge wrote: > Hi all, > another idea for a potential info pool in that term could be a compatibilit= y list for the different ciphers and digests and the different OS=C2=B4s (es= pecially the OpenSSL-1.0.1f library, which comes with IPFire-2.15, brought so= me new ones) . > For example the CAMELLIA or SEED cipher aren=C2=B4t compatible with mostly = smartphones and also some older OS=C2=B4s like OS X 10.6 (which is still wide= ly used) or Windows 7 and below.=20 > But also the Whirlpool or SHA384/512 hash algorithms are interesting to che= ck against common but also older operating systems, to name a few. This is indeed a very good idea and of course influences the decision a lot. I am just wondering if we are able to have a global matrix for OpenVPN and IPsec or if we need to split that up? I would suggest to have two different matrices for that. > For the OpenVPN server on IPFire for example the ciphers and digests (selec= tion in the WUI is in development) are globally defined and a fallback to old= er ciphers/digests isn=C2=B4t possible at this time. If a wide range of diffe= rent client OS=C2=B4s are used now, the question on the lowest common denomin= ator possibly comes up. So a compatibility list can help to make a good decis= ion. > We have started with a little list --> http://wiki.ipfire.org/en/configurat= ion/services/openvpn/extensions/zertkonvert#openvpns_cipher_and_digests_tests= _with_openssl_version_101f which should only help temporarily for testing pur= poses and should only serve an idea/example to this. I would also like to suggest to make two matrices. One for the ciphers, one for the hashing algorithms. That makes it a bit easier because the table doesn't get too huge. > Another point might be a timeline for the generation of the root/host certi= ficates. We work currently on a flip menu in OpenVPN WUI where different bit = sizes of the Diffie-Hellman key can be selected (1024, 2048, 3072 and 4096).= The generation time for 4096 bit on a ALIX platform needed for example ~ 13 = hours, 1024 bit instead 1.5 minutes, people might think something is broken w= hile generating a new PKI so a hint for generation can help to understand suc= h process better ? With beta 1, generating keys on ALIX boards should be done within a second because the RNG is used for that. Benchmarking the times is nothing different than a measurement for how much entropy is generated by the system, so I think that there is not too much use for this. You will have to wait the time it takes to generate the key. If it takes way too long, than you should search for a source of entropy. We have still lots of other places to work on, so I would like to keep this as short as possible and cut everything that is not essentially required. >=20 > This points does not targeting how strong or week or useful a cipher/hash o= r a key is now, but this can give also some technical background info=C2=B4s. Are you planning to point to sources? That is fine. But please do not copy or re-write texts about how AES works internally. > -------------- >=20 > A reference to different organizations with crypto background can also be a= n interesting point in that kind of wiki. >=20 > For example: > - http://www.iacr.org/ > - https://www.cosic.esat.kuleuven.be/nessie/ > - http://www.ecrypt.eu.org/ > - http://www.ecrypt.eu.org/stream/ > - http://www.nist.org/news.php > - https://www.teletrust.de/ > - https://www.bsi.bund.de/EN/Publications/publications_node.html >=20 > Possibly some special section are more interesting then others, but as a fi= rst idea ??? >=20 > Greetings=20 >=20 >=20 > Erik >=20 >=20 >=20 > _______________________________________________ > Documentation mailing list > Documentation(a)lists.ipfire.org > http://lists.ipfire.org/mailman/listinfo/documentation > Return-Path: > Received: from mail01.ipfire.org > by hedwig.ipfire.org (Dovecot) with LMTP id 56ilKlq89FIJbwAAjPkmHg > ; Fri, 07 Feb 2014 11:58:34 +0100 > Received: from hedwig.ipfire.org (localhost [IPv6:::1]) > by mail01.ipfire.org (Postfix) with ESMTP id A1C9F2101; > Fri, 7 Feb 2014 11:58:34 +0100 (CET) > Received: from [192.168.75.2] (dslb-084-057-122-162.pools.arcor-ip.net > [84.57.122.162]) > (using TLSv1 with cipher ECDHE-RSA-AES128-SHA (128/128 bits)) > (No client certificate requested) > by mail01.ipfire.org (Postfix) with ESMTPSA id 05101180 > for ; Fri, 7 Feb 2014 11:58:32 +0100 (C= ET) > Mime-Version: 1.0 (Apple Message framework v1085) > Subject: Re: Cryptography > From: ummeegge > In-Reply-To: <1391696720.21794.100.camel(a)rice-oxley.tremer.info> > Date: Fri, 7 Feb 2014 11:58:26 +0100 > Message-Id: <588CE637-2C6C-4F5B-9208-811574F2E5D8(a)ipfire.org> > References: <1391694769.21794.92.camel(a)rice-oxley.tremer.info> > <52F398ED.2080901(a)rymes.com> > <1391696720.21794.100.camel(a)rice-oxley.tremer.info> > To: documentation(a)lists.ipfire.org > X-Mailer: Apple Mail (2.1085) > X-BeenThere: documentation(a)lists.ipfire.org > X-Mailman-Version: 2.1.15 > Precedence: list > List-Id: "Discussions about the wiki, > translations and stuff..." > List-Unsubscribe: , > > List-Archive: > List-Post: > List-Help: > List-Subscribe: , > > Content-Type: text/plain; charset=3D"iso-8859-1" > Content-Transfer-Encoding: quoted-printable > Errors-To: documentation-bounces(a)lists.ipfire.org > Sender: "Documentation" >=20 > Hi all, > another idea for a potential info pool in that term could be a compatibilit= y list for the different ciphers and digests and the different OS=C2=B4s (es= pecially the OpenSSL-1.0.1f library, which comes with IPFire-2.15, brought so= me new ones) . > For example the CAMELLIA or SEED cipher aren=C2=B4t compatible with mostly = smartphones and also some older OS=C2=B4s like OS X 10.6 (which is still wide= ly used) or Windows 7 and below.=20 > But also the Whirlpool or SHA384/512 hash algorithms are interesting to che= ck against common but also older operating systems, to name a few. >=20 > For the OpenVPN server on IPFire for example the ciphers and digests (selec= tion in the WUI is in development) are globally defined and a fallback to old= er ciphers/digests isn=C2=B4t possible at this time. If a wide range of diffe= rent client OS=C2=B4s are used now, the question on the lowest common denomin= ator possibly comes up. So a compatibility list can help to make a good decis= ion. > We have started with a little list --> http://wiki.ipfire.org/en/configurat= ion/services/openvpn/extensions/zertkonvert#openvpns_cipher_and_digests_tests= _with_openssl_version_101f which should only help temporarily for testing pur= poses and should only serve an idea/example to this. >=20 > Another point might be a timeline for the generation of the root/host certi= ficates. We work currently on a flip menu in OpenVPN WUI where different bit = sizes of the Diffie-Hellman key can be selected (1024, 2048, 3072 and 4096).= The generation time for 4096 bit on a ALIX platform needed for example ~ 13 = hours, 1024 bit instead 1.5 minutes, people might think something is broken w= hile generating a new PKI so a hint for generation can help to understand suc= h process better ? >=20 > This points does not targeting how strong or week or useful a cipher/hash o= r a key is now, but this can give also some technical background info=C2=B4s. >=20 > -------------- >=20 > A reference to different organizations with crypto background can also be a= n interesting point in that kind of wiki. >=20 > For example: > - http://www.iacr.org/ > - https://www.cosic.esat.kuleuven.be/nessie/ > - http://www.ecrypt.eu.org/ > - http://www.ecrypt.eu.org/stream/ > - http://www.nist.org/news.php > - https://www.teletrust.de/ > - https://www.bsi.bund.de/EN/Publications/publications_node.html >=20 > Possibly some special section are more interesting then others, but as a fi= rst idea ??? >=20 > Greetings=20 >=20 >=20 > Erik >=20 >=20 >=20 > _______________________________________________ > Documentation mailing list > Documentation(a)lists.ipfire.org > http://lists.ipfire.org/mailman/listinfo/documentation --===============0946661049654835723==--