...
- Create a new version of the PEPPOL AS2 specification (e.g. v.1.2 - and not v.1.1 to avoid confusion since current version is 1.0.1) that references RFC 5751 instead of RFC 3851; also to add a note what the implications are (SHA-256 mandatory)
- Decide on a point in time where only the new algorithm names (with '-') will be supported (see 4-7 below)
- Suggestion on how to proceed (2018-04-27)
- Define a
- date X where receiving APs must be able to support both versions of the algorithm names (with '-' and without '-')
- By default the message should be send with : "sha1", "sha-1", "sha256", "sha-256" algorithm
- If that fails, the sender must fall back to "sha1" algorithm
- Question: is there a standardized error message to indicate "unsupported MIC algorithm"?
- The implications are: each sending AP must be able to fallback (at a certain point in time)
- Starting on X 1st
- senders and receivers MAY start using "sha-256"
- receivers may start supporting "sha-256"
- Starting on Y 1st
- all receivers MUST support "sha-256" in parallel to "sha1"
- Starting on Z 1st
- all sender MUST only send "sha-256"; therefore receivers can drop support for "sha1"
- From date "X+1 day", sending APs should switch MDN MIC algorithms
- from "sha1" [...]
- to "sha-256", "sha256", "sha-1", "sha1" (in that order)
- By date Y (after X)
- receiving APs may drop support for "sha-1", "sha1" and "sha256". Only "sha-256" is mandatory
- sending AP must use "sha-256" only
- From date "X+1 day", sending APs should switch MDN MIC algorithms
If the above proposal is approved by MC and eDelivery CMB, next steps are:
- Update PEPPOL AS2 specification document, make a eDelivery CMB decision and then publish it A.S.A.P
- Verify that existing AP implementations can support "sha-256" according to RFC 5751 (S/MIME 3.2)
- Find values (year and month) for X , and Y and Z (see 4-7 bullet point 3 above)
- Evaluate other changes from RFC 5751 compared to RFC 3851 for "show stoppers" concerning interoperability
- Maintain a Confluence page that gathers all the information as well as known tool support
...