- From: Christian Geuer-Pollmann <geuer-pollmann@nue.et-inf.uni-siegen.de>
- Date: Wed, 19 Jun 2002 14:48:13 +0200
- To: Tom Gindin <tgindin@us.ibm.com>, Donald Eastlake 3rd <dee3@torque.pothole.com>
- Cc: "Ahmed, Zahid" <zahid.ahmed@commerceone.com>, "'reagle@w3.org'" <reagle@w3.org>, "'xml-encryption@w3.org'" <xml-encryption@w3.org>, "'blaird@microsoft.com'" <blaird@microsoft.com>, Takeshi Imamura <IMAMU@jp.ibm.com>, "Sanfilippo, Joe" <joe.sanfilippo@commerceone.com>
Just another link on that topic: <http://lists.w3.org/Archives/Public/xml-encryption/2002Jan/0122.html> Christian --On Mittwoch, 19. Juni 2002 08:11 -0400 Tom Gindin <tgindin@us.ibm.com> wrote: > Don: > > Not all the missing algorithms are weak ones. The entire class of > password-based encryption algorithms are not defined. Admittedly, there's > no reason to make them mandatory to support, nor to define everything in > sight (I've catalogued 15 PKCS#5 or PKCS#12 variants using SHA-1 as their > digest, before AES came out), but a few of them would probably help. I > would suggest pkcs-12-PBEWithSha1AndTripleDESCBC and > pbeWithSHAAnd3-KeyTripleDES-CC (see PKCS#12 section 6.3) for a start. > > Tom Gindin
Received on Wednesday, 19 June 2002 08:55:50 UTC