On 2/08/2013 11:39 PM, Burns, Robert wrote:
Just
following up on these proposals. I’ve reviewed each and all
but one are relatively non-contentious and minimally
invasive.
I do like this proposal and think it is necessary
to enable DSA functions for domain parameter and key sizes
other than 1024/160.
I agree with Bob, and I have voted accordingly - I would like to see
a follow up proposal on the DSA parameter generation side of things
and get both Oscar and BobR's views on the whole FIPS186-4 reference
issue and the new proposal from Oscar.
Mike's comment on an approach to have this mechanism remain
backwards compatible by having a default for CKA_SUBPRIME_BITS is a
good one and I would like to see it incorporated - although that it
is missing isn't enough to vote No on the proposal as in its present
form the mechanism is pretty useless being limited to primes of 512
to 1024 bit with 160 bits for sub prime.
There isn't a mechanism to vote yes-with-changes (deliberately) so
getting such comments in earlier is important as otherwise we have
to have subsequent votes to get items included - although for the
change to have a default I think we could handle that as a
resolution in the meeting if there is a general consensus on that
topic.
Thanks,
Tim.
|