[Security Baseline] Which strings to be used for PasswordBasedEncryptionAlgorithms capabilities values required at Security Baseline

[MariaYa0091]

The following is required at baseline:

How this should be presented at PasswordBasedEncryptionAlgorithms capability?
pBKDF2 (http://oidref.com/1.2.840.113549.1.5.12)?

Previously the following value was required: pbeWithSHAAnd3-KeyTripleDES-CBC (http://oidref.com/1.2.840.113549.1.12.1.3#google_vignette)

[sujithhanwha]

PBKDF2: The mechanism to create a key from a password.
AES-128-CBC: The cipher used to encrypt the data with that key.

Can we define a custom identifier "PBKDF2-AES-128-CBC" for this , to be used in PasswordBasedEncryptionAlgorithms capability?
Since we don't have anything similar to pbeWithSHAAnd3-KeyTripleDES-CBC defined for above combination.

[MariaYa0091]

Hello @sujithhanwha!

Is there any progress on discussion about this? This question is blocking part of Security Baseline test cases as well as removing dependency on sha1.

[ocampana-videotec]

@MariaYa0091 this issue will be discussed the F2F meeting in Budapest

[AxelKeskikangas]

Hi, from my point of view the things that corresponds to pbeWithSHAAnd3-KeyTripleDES-CBC is something like pbkdf2hmacWithSHA256 (or SHA512, SHA384) depending on what you want. This will generate the key that is then used.

Separately we list the symmetric encryption algorithms, where we currently dont list AES-128-CBC which we should address this. Johan, Sriram & me are working on a PR to clarify.

Then it is baseline for the use case "private key encryption" which is unfortunately similar to the capability "asymmetric encryption schemes".

[MariaYa0091]

Note: PasswordBasedEncryptionAlgorithms capability is used for PKCS12.

[HansBusch]

RFC 9579 defines the IANA identifier id-pkcs12-pbmac1-2023. How about using this?