Subject: Re: CONSENSUS CALL - PKINIT "SHOULD group 16"

From: Jeffrey Hutzelman <[email-masked]>
Date: Mon, 14 Mar 2005 13:00:07 -0500

On Monday, February 07, 2005 10:41:05 PM -0500 Sam Hartman 
<[email-masked]> wrote:

>>>>>> "Jeffrey" == Jeffrey Hutzelman <[email-masked]> writes:
>     Jeffrey> This is part of ticket #530.  As of -22, DH group 2 was
>     Jeffrey> REQUIRED and group 14 was RECOMMENDED.  This was the
>     Jeffrey> result of a consensus arrived at during and after IETF60.
>     Jeffrey> Larry has proposed also making group 16 RECOMMENDED.  The
>     Jeffrey> text for this appeared in pkinit-23 and will be present
>     Jeffrey> in pkinit-24.
>
> Speaking as an AD, pkinit must have a DH group strong enough to meet
> the requirements of BCP 86 for the symmetric keys expected to be used
> with pkinit.  If AES-128 is not mandated by pkinit it must have DH
> groups strong enough for AES-256.

These are separate issues.  AES128 support is ticket #834.
I agree we need either AES128 or groups strong enough for AES256.

> Speaking as an individual, I support this change.

Same here.  It would be nice if others would comment; I don't think Larry, 
Sam, and I quite constitute a consensus of the WG.

-- Jeff

---

From: Jeffrey Altman <[email-masked]>
Date: Tue, 15 Mar 2005 14:00:54 -0500

Jeffrey Hutzelman wrote:

> Same here.  It would be nice if others would comment; I don't think 
> Larry, Sam, and I quite constitute a consensus of the WG.
> 
> -- Jeff

I support making group 16 Recommended.

Jeffrey Altman

---

From: Ken Raeburn <[email-masked]>
Date: Tue, 15 Mar 2005 15:11:50 -0500

> I support making group 16 Recommended.

"me too"

Ken

---

From: Love Hörnquist Åstrand <[email-masked]>
Date: Fri, 18 Mar 2005 01:09:26 +0100

>> I support making group 16 Recommended.

Indeed.

Love