RE: New version of rsa-sha2-512 draft posted: no more DSA

[Peter Gutmann <pgut001%cs.auckland.ac.nz@localhost>]

denis bider <ietf-ssh3%denisbider.com@localhost> writes:

>I have taken into account Damien's suggestion for rsa-sha2-512, and observed
>that there appears to be no reason to have rsa-sha2-256, if we have rsa-
>sha2-512. As far as I can tell, SHA-2 512 should be reasonably available
>everywhere that SHA-2 256 is available.

Uhh, that's more or less the opposite of the actual situation: SHA2-256 is
fast becoming the universal replacement for SHA-1, while SHA2-512 is the "oh,
there's another one alongside -256?" alternative.  For example Mozilla just
posted the following discussion item:

  In item #8 of the Maintenance Policy recommend that CAs avoid SHA-512 and
  P-521, especially in their CA certificates. This is to ensure
  interoperability, as SHA-512 and (especially) P-521 are less well-supported
  than the other algorithms.

So it should be MUST -256, MAY -512, at most.

(I can't see any good reason to have -512, it has little support, it's a pain
to do on 32-bit CPUs, it's slow, and it offers little to no practical security
advantage over -256).

Peter.