Hi,
On Fri, 2014-02-07 at 11:58 +0100, ummeegge wrote:
Hi all, another idea for a potential info pool in that term could be a compatibility list for the different ciphers and digests and the different OS´s (especially the OpenSSL-1.0.1f library, which comes with IPFire-2.15, brought some new ones) . For example the CAMELLIA or SEED cipher aren´t compatible with mostly smartphones and also some older OS´s like OS X 10.6 (which is still widely used) or Windows 7 and below. But also the Whirlpool or SHA384/512 hash algorithms are interesting to check against common but also older operating systems, to name a few.
This is indeed a very good idea and of course influences the decision a lot.
I am just wondering if we are able to have a global matrix for OpenVPN and IPsec or if we need to split that up? I would suggest to have two different matrices for that.
For the OpenVPN server on IPFire for example the ciphers and digests (selection in the WUI is in development) are globally defined and a fallback to older ciphers/digests isn´t possible at this time. If a wide range of different client OS´s are used now, the question on the lowest common denominator possibly comes up. So a compatibility list can help to make a good decision. We have started with a little list --> http://wiki.ipfire.org/en/configuration/services/openvpn/extensions/zertkonv... which should only help temporarily for testing purposes and should only serve an idea/example to this.
I would also like to suggest to make two matrices. One for the ciphers, one for the hashing algorithms. That makes it a bit easier because the table doesn't get too huge.
Another point might be a timeline for the generation of the root/host certificates. We work currently on a flip menu in OpenVPN WUI where different bit sizes of the Diffie-Hellman key can be selected (1024, 2048, 3072 and 4096). The generation time for 4096 bit on a ALIX platform needed for example ~ 13 hours, 1024 bit instead 1.5 minutes, people might think something is broken while generating a new PKI so a hint for generation can help to understand such process better ?
With beta 1, generating keys on ALIX boards should be done within a second because the RNG is used for that. Benchmarking the times is nothing different than a measurement for how much entropy is generated by the system, so I think that there is not too much use for this. You will have to wait the time it takes to generate the key. If it takes way too long, than you should search for a source of entropy.
We have still lots of other places to work on, so I would like to keep this as short as possible and cut everything that is not essentially required.
This points does not targeting how strong or week or useful a cipher/hash or a key is now, but this can give also some technical background info´s.
Are you planning to point to sources? That is fine. But please do not copy or re-write texts about how AES works internally.
A reference to different organizations with crypto background can also be an interesting point in that kind of wiki.
For example:
- http://www.iacr.org/
- https://www.cosic.esat.kuleuven.be/nessie/
- http://www.ecrypt.eu.org/
- http://www.ecrypt.eu.org/stream/
- http://www.nist.org/news.php
- https://www.teletrust.de/
- https://www.bsi.bund.de/EN/Publications/publications_node.html
Possibly some special section are more interesting then others, but as a first idea ???
Greetings
Erik
Documentation mailing list Documentation@lists.ipfire.org http://lists.ipfire.org/mailman/listinfo/documentation Return-Path: documentation-bounces@lists.ipfire.org Received: from mail01.ipfire.org by hedwig.ipfire.org (Dovecot) with LMTP id 56ilKlq89FIJbwAAjPkmHg ; Fri, 07 Feb 2014 11:58:34 +0100 Received: from hedwig.ipfire.org (localhost [IPv6:::1]) by mail01.ipfire.org (Postfix) with ESMTP id A1C9F2101; Fri, 7 Feb 2014 11:58:34 +0100 (CET) Received: from [192.168.75.2] (dslb-084-057-122-162.pools.arcor-ip.net [84.57.122.162]) (using TLSv1 with cipher ECDHE-RSA-AES128-SHA (128/128 bits)) (No client certificate requested) by mail01.ipfire.org (Postfix) with ESMTPSA id 05101180 for documentation@lists.ipfire.org; Fri, 7 Feb 2014 11:58:32 +0100 (CET) Mime-Version: 1.0 (Apple Message framework v1085) Subject: Re: Cryptography From: ummeegge ummeegge@ipfire.org In-Reply-To: 1391696720.21794.100.camel@rice-oxley.tremer.info Date: Fri, 7 Feb 2014 11:58:26 +0100 Message-Id: 588CE637-2C6C-4F5B-9208-811574F2E5D8@ipfire.org References: 1391694769.21794.92.camel@rice-oxley.tremer.info 52F398ED.2080901@rymes.com 1391696720.21794.100.camel@rice-oxley.tremer.info To: documentation@lists.ipfire.org X-Mailer: Apple Mail (2.1085) X-BeenThere: documentation@lists.ipfire.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: "Discussions about the wiki, translations and stuff..." <documentation.lists.ipfire.org> List-Unsubscribe: http://lists.ipfire.org/mailman/options/documentation, mailto:documentation-request@lists.ipfire.org?subject=unsubscribe List-Archive: http://lists.ipfire.org/pipermail/documentation/ List-Post: mailto:documentation@lists.ipfire.org List-Help: mailto:documentation-request@lists.ipfire.org?subject=help List-Subscribe: http://lists.ipfire.org/mailman/listinfo/documentation, mailto:documentation-request@lists.ipfire.org?subject=subscribe Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Errors-To: documentation-bounces@lists.ipfire.org Sender: "Documentation" documentation-bounces@lists.ipfire.org
Hi all, another idea for a potential info pool in that term could be a compatibility list for the different ciphers and digests and the different OS´s (especially the OpenSSL-1.0.1f library, which comes with IPFire-2.15, brought some new ones) . For example the CAMELLIA or SEED cipher aren´t compatible with mostly smartphones and also some older OS´s like OS X 10.6 (which is still widely used) or Windows 7 and below. But also the Whirlpool or SHA384/512 hash algorithms are interesting to check against common but also older operating systems, to name a few.
For the OpenVPN server on IPFire for example the ciphers and digests (selection in the WUI is in development) are globally defined and a fallback to older ciphers/digests isn´t possible at this time. If a wide range of different client OS´s are used now, the question on the lowest common denominator possibly comes up. So a compatibility list can help to make a good decision. We have started with a little list --> http://wiki.ipfire.org/en/configuration/services/openvpn/extensions/zertkonv... which should only help temporarily for testing purposes and should only serve an idea/example to this.
Another point might be a timeline for the generation of the root/host certificates. We work currently on a flip menu in OpenVPN WUI where different bit sizes of the Diffie-Hellman key can be selected (1024, 2048, 3072 and 4096). The generation time for 4096 bit on a ALIX platform needed for example ~ 13 hours, 1024 bit instead 1.5 minutes, people might think something is broken while generating a new PKI so a hint for generation can help to understand such process better ?
This points does not targeting how strong or week or useful a cipher/hash or a key is now, but this can give also some technical background info´s.
A reference to different organizations with crypto background can also be an interesting point in that kind of wiki.
For example:
- http://www.iacr.org/
- https://www.cosic.esat.kuleuven.be/nessie/
- http://www.ecrypt.eu.org/
- http://www.ecrypt.eu.org/stream/
- http://www.nist.org/news.php
- https://www.teletrust.de/
- https://www.bsi.bund.de/EN/Publications/publications_node.html
Possibly some special section are more interesting then others, but as a first idea ???
Greetings
Erik
Documentation mailing list Documentation@lists.ipfire.org http://lists.ipfire.org/mailman/listinfo/documentation