Cryptographic algorithms
The references and standards for cryptographic algorithm support are subject to ongoing review and may be updated as needed.
Signature Algorithm
The signing algorithm used when verifying a signature MUST meet the following requirements:
The allowed list (validating side) is:
ES256(RECOMMENDED)ES384ES512PS256PS384PS512
You MUST support one of the signature algorithms included in these allowed lists.
Verifiers MUST refuse to verify with any signature algorithm not included in this allowed list.
We recommend ES256 as a good balance between performance and security, but do not prohibit the use of other signature algorithms.
Implementers are RECOMMENDED to periodically review algorithms and discontinue use of compromised algorithms.
Hash algorithm
Applications that comply with the OP's specifications MUST meet the following requirements for the hash algorithms used when generating and verifying the integrity property value of the CA's Content Integrity Descriptor and when generating and verifying the digestSRI property value of each VC.
Verifiers MUST support verification using SHA-256 hash values, and MAY support verification using SHA-384 and SHA-512 hash values.
Implementers should periodically review hash algorithms and avoid using compromised hash algorithms.
Security Considerations
This section is non-normative.
Guidelines regarding key updates, the review of cryptographic algorithms, and migration are provided based on RFC 7696 Section 2.2.3. Reference is made to NIST SP 800-57 Part 1, NIST SP 800-131A Rev.3 (Initial Public Draft), and CRYPTREC's List of Cryptographic Algorithms (LS-0001-2022R2) and Criteria for Setting Cryptographic Strength Requirements (LS-0003-2022R1). The allowed list in this document includes cryptographic algorithms recommended or approved in these documents.
Security Strengths
NIST SP 800-57 Part 1 and CRYPTREC's Criteria for Setting Cryptographic Strength Requirements (LS-0003-2022R1) specify that new cryptographic protections (such as signature generation) using cryptographic algorithms and key lengths with a security strength of 112 bits should cease by 2030 and should not be used from 2031 onwards.
The NIST SP 800-131A Rev.3 (Initial Public Draft) proposes designating 112-bit signatures and key establishment as "deprecated" (not prohibited) from 2031 onwards, and outlines a transition path directly to post-quantum cryptographic algorithms without passing through a 128-bit security strength.
The security strengths corresponding to the allowed list of cryptographic algorithms defined in this document are as follows:
Signing Algorithms
- ES256: 128 bits
- ES384: 192 bits
- ES512: 256 bits
- PS256: ~128 bits 1
- PS384: ~192 bits 1
- PS512: ~256 bits 1
Hash Algorithms
- SHA-256: 128 bits
- SHA-384: 192 bits
- SHA-512: 256 bits
Recommended Cryptoperiods
NIST SP 800-57 Part 1 Section 5.3.6 provides the recommended cryptoperiods for the following key types:
- Signing Keys: 1 to 3 years for the period of use for signing.
- Verification Keys: A few years (dependent on key size).
It is advisable to update keys based on these recommended cryptoperiods, and for establishing longer cryptoperiods, the necessity of key updates due to key compromise should be considered.
Migration to New Cryptographic Algorithms and Key Lengths
NIST SP 800-57 Part 1 Section 5.6.4 discusses the considerations for migration due to the lifetime of the cryptographic algorithms and key lengths in use (the point at which the protection of data by that algorithm and key length is no longer considered secure).
If the period for which signature verification must be possible exceeds the lifetime of the cryptographic algorithm and key length, no new signatures should be created with that algorithm and key length. Furthermore, data that is already within the signature verification period should be re-signed with a different cryptographic algorithm and key length to provide protection for the remaining period.
Cryptographic Key Protection and Assurance Requirements
NIST SP 800-57 Part 1 Section 6.1.1 outlines the cryptographic key protection and assurance requirements as follows:
- Signing Keys: Assurance of confidentiality and integrity throughout their possession, from generation until the end of the cryptoperiod.
- Verification Keys: Assurance of integrity and availability of their validity, from generation until the signed data no longer requires verification.
If a security incident—such as an operational error—results in a situation where the aforementioned requirements for the protection and assurance of signing keys (e.g., preventing key compromise) are no longer met, the Originator Profile necessitates key rotation, as well as the re-issuance and re-deployment of all previously issued VCs. To avoid such scenarios, a mechanism should be employed that makes it fundamentally impossible to extract the signing key. Specific examples of such mechanisms include Key Management Service (KMS) and Hardware Security Module (HSM).