idnits 2.17.00 (12 Aug 2021) /tmp/idnits24421/draft-popov-cryptopro-cpalgs-01.txt: Checking boilerplate required by RFC 5378 and the IETF Trust (see https://trustee.ietf.org/license-info): ---------------------------------------------------------------------------- ** Looks like you're using RFC 2026 boilerplate. This must be updated to follow RFC 3978/3979, as updated by RFC 4748. Checking nits according to https://www.ietf.org/id-info/1id-guidelines.txt: ---------------------------------------------------------------------------- ** The document seems to lack a 1id_guidelines paragraph about 6 months document validity -- however, there's a paragraph with a matching beginning. Boilerplate error? Checking nits according to https://www.ietf.org/id-info/checklist : ---------------------------------------------------------------------------- ** The document seems to lack an IANA Considerations section. (See Section 2.2 of https://www.ietf.org/id-info/checklist for how to handle the case when there are no actions for IANA.) ** The document seems to lack separate sections for Informative/Normative References. All references will be assumed normative when checking for downward references. Miscellaneous warnings: ---------------------------------------------------------------------------- == The copyright year in the RFC 3978 Section 5.4 Copyright Line does not match the current year == Line 706 has weird spacing: '...modules gostR...' == Line 712 has weird spacing: '...modules gostR...' == Line 716 has weird spacing: '...modules gostR...' == The document seems to lack the recommended RFC 2119 boilerplate, even if it appears to use RFC 2119 keywords. (The document does seem to have the reference to RFC 2119 which the ID-Checklist requires). -- The document seems to lack a disclaimer for pre-RFC5378 work, but may have content which was first submitted before 10 November 2008. If you have contacted all the original authors and they are all willing to grant the BCP78 rights to the IETF Trust, then this is fine, and you can ignore this comment. If not, you may need to add the pre-RFC5378 disclaimer. (See the Legal Provisions document at https://trustee.ietf.org/license-info for more information.) -- The document date (March 31, 2004) is 6624 days in the past. Is this intentional? Checking references for intended status: Informational ---------------------------------------------------------------------------- -- Looks like a reference, but probably isn't: '0' on line 825 -- Looks like a reference, but probably isn't: '1' on line 382 -- Looks like a reference, but probably isn't: '7' on line 378 -- Looks like a reference, but probably isn't: '8' on line 393 == Missing Reference: 'GOST341194' is mentioned on line 507, but not defined ** Obsolete normative reference: RFC 2246 (ref. 'TLS') (Obsoleted by RFC 4346) Summary: 5 errors (**), 0 flaws (~~), 6 warnings (==), 6 comments (--). Run idnits with the --verbose option for more detailed information about the items above. -------------------------------------------------------------------------------- 1 Internet Draft Vladimir Popov, CRYPTO-PRO 2 Igor Kurepkin, CRYPTO-PRO 3 Expires September 30, 2004 Serguei Leontiev, CRYPTO-PRO 4 Intended Category: Informational March 31, 2004 6 Additional cryptographic algorithms for use with GOST 28147-89, 7 GOST R 34.10-94, GOST R 34.10-2001, and GOST R 34.11-94 algorithms. 9 11 Status of this Memo 13 This document is an Internet-Draft and is subject to all provisions 14 of Section 10 of RFC2026. 16 Internet-Drafts are working documents of the Internet Engineering 17 Task Force (IETF), its areas, and its working groups. Note that 18 other groups may also distribute working documents as Internet- 19 Drafts. 21 Internet-Drafts are draft documents valid for a maximum of six months 22 and may be updated, replaced, or made obsolete by other documents at 23 any time. It is inappropriate to use Internet-Drafts as reference 24 material or to cite them other than as "work in progress." 26 The list of current Internet-Drafts can be accessed at 27 http://www.ietf.org/1id-abstracts.html 29 The list of Internet-Draft Shadow Directories can be accessed at 30 http://www.ietf.org/shadow.html 32 Abstract 34 This document describes cryprographic algorithms and parameters, 35 supplementary to GOST 28147-89, GOST R 34.10-94, GOST R 34.10-2001 36 and GOST R 34.11-94, for use in internet applications. 38 Table of Contents 39 1 Introduction . . . . . . . . . . . . . . . . . . . . . . 2 40 1.2 Terminology. . . . . . . . . . . . . . . . . . . . . . . 2 41 2 Cipher modes and parameters. . . . . . . . . . . . . . . 3 42 2.1 GOST 28147-89 CBC mode . . . . . . . . . . . . . . . . . 3 43 2.2 GOST 28147-89 padding modes. . . . . . . . . . . . . . . 4 44 2.3 Key Meshing Algorithms . . . . . . . . . . . . . . . . . 4 45 2.3.1 Null Key Meshing . . . . . . . . . . . . . . . . . . . . 4 46 2.3.2 CryptoPro Key Meshing. . . . . . . . . . . . . . . . . . 4 47 3 HMAC_GOSTR3411 . . . . . . . . . . . . . . . . . . . . . 5 48 4 PRF_GOSTR3411. . . . . . . . . . . . . . . . . . . . . . 5 49 5 Key Derivation Algorithms. . . . . . . . . . . . . . . . 5 50 5.1 VKO GOST R 34.10-94. . . . . . . . . . . . . . . . . . . 5 51 5.2 VKO GOST R 34.10-2001. . . . . . . . . . . . . . . . . . 6 52 6 Key Wrap algorithms. . . . . . . . . . . . . . . . . . . 6 53 6.1 GOST 28147-89 Key Wrap . . . . . . . . . . . . . . . . . 6 54 6.2 GOST 28147-89 Key Unrap. . . . . . . . . . . . . . . . . 7 55 6.3 CryptoPro Key Wrap . . . . . . . . . . . . . . . . . . . 7 56 6.4 CryptoPro Key Unwrap . . . . . . . . . . . . . . . . . . 8 57 6.5 CryptoPro KEK Diversification Algorithm. . . . . . . . . 8 58 7 Secret Key Diversification . . . . . . . . . . . . . . . 9 59 8 Algorithm parameters . . . . . . . . . . . . . . . . . . 9 60 8.1 Encryption algorithm parameters . . . . . . . . . . . . 9 61 8.2 Digest algorithm parameters. . . . . . . . . . . . . . . 11 62 8.3 GOST R 34.10-94 public key algorithm parameters . . . . 11 63 8.4 GOST R 34.10-2001 public key algorithm parameters. . . . 12 64 9 Security Considerations. . . . . . . . . . . . . . . . . 13 65 10 Appendix ASN.1 Modules . . . . . . . . . . . . . . . . . 14 66 11 References . . . . . . . . . . . . . . . . . . . . . . . 49 67 12 Acknowledgments. . . . . . . . . . . . . . . . . . . . . 51 68 Author's Address. . . . . . . . . . . . . . . . . . . . . . . . 51 69 Full Copyright Statement. . . . . . . . . . . . . . . . . . . . 53 71 1 Introduction 73 Russian cryptographic standards defining algorithms GOST 28147-89 74 [GOST28147], GOST R 34.10-94 [GOSTR341094], GOST R 34.10-2001 75 [GOSTR34102001] and GOST R34.11-94 [GOSTR341194] (a brief english 76 technical description of these algorithms can be found in 77 [Schneier95]) provide basic information about how the algorithms 78 work, but need supplemental specifications to effectively use the 79 algorithms. 81 This document is a proposal put forward by CRYPT-PRO Company to 82 provide the supplemental information and specifications needed by the 83 "Russian Cryptographic Software Compatibility Agreement" community. 85 1.2 Terminology 87 In this document, the key words MUST, MUST NOT, REQUIRED, SHOULD, 88 SHOULD NOT, RECOMMENDED, and MAY are to be interpreted as described 89 in [RFC 2119]. 91 The following functions and operators are also used in this document: 93 '|' stands for concatenation 95 encryptECB (K, D) - is D, encrypted with key K using GOST 28147-89 in 96 "prostaya zamena" (ECB) mode 98 decryptECB (K, D) - is D, decrypted with key K using GOST 28147-89 in 99 ECB mode 101 encryptCFB (IV, K, D) - is D, encrypted with key K using GOST 102 28147-89 in "gammirovanie s obratnoj svyaziyu" (64-bit CFB) mode, and 103 IV as initialization vector. 105 encryptCNT (IV, K, D) - is D, encrypted with key K using GOST 106 28147-89 in "gammirovanie" (counter) mode, and IV as initialization 107 vector. 109 gostR3411 (D) - is the 256-bit result of GOST R 34.11-94 hash 110 function, used with zero intitialization vector, and S-Box parameter, 111 defined by gostR3411CryptoProParamSetAI (see Appendix, 112 GostR3411-94-ParamSetSyntax module). 114 gost28147IMIT (IV, K, D) - is the 32-bit result of GOST 28147-89 in 115 "imitovstavka" (MAC) mode, used with D as plaintext, K as key and IV 116 as initialization vector. Note, that standard specifies it's use in 117 this mode only with zero initialization vector. 119 When keys and initialization vectors are converted to/from byte 120 arrays, little-endian byte order is assumed. 122 2 Cipher modes and parameters 124 [GOST28147] defines only three cipher modes for GOST 28147-89: ECB, 125 CFB and counter mode. This document defines an additional cipher mode 126 CBC. 128 When GOST 28147-89 is used to process large amounts of data, a 129 symmetric key should be protected by key meshing algorithm. This 130 document defines CryptoPro key meshing algorithm. 132 The cipher mode, key meshing algorithm, padding mode and S-box are 133 specified by algorithm parameters. 135 2.1 GOST 28147-89 CBC mode 137 This section provides the supplemental information to GOST 28147-89 138 (a block to block primitive) needed to operate in CBC mode. 140 Before each plaintext block is encrypted, it is combined with the 141 cipher text of the previous block by a bitwise XOR operation. This 142 ensures that even if the plaintext contains many identical blocks, 143 they will each encrypt to a different cipher text block. The 144 initialization vector is combined with the first plaintext block by a 145 bitwise XOR operation before the block is encrypted. 147 2.2 GOST 28147-89 padding modes 149 This section provides the supplemental information to GOST 28147-89, 150 needed to operate on plaintext, which length is not divisible by GOST 151 28147-89 block size (8 bytes). 153 Let x (0 < x < 8) be the number of bytes in the last (possibly, 154 incomplete) block of data. There are three padding modes: 155 * Zero padding: 8-x remaining bytes are filled with zero 156 * PKCS#5 padding: 8-x remaining bytes are filled with value of 8-x. 157 If there's no incomplete block, one extra block filled with 158 value 8 is added. 159 * Random padding: 8-x remaining bytes of the last block are 160 set to random. 162 2.3 Key Meshing Algorithms 164 When there is a need to limit the amount of data, enciphered with the 165 same key, several key meshing algorithms can be used. Key meshing 166 algorithms transform the key after processing a certain amount of 167 data. 169 All encryption parameter sets, defined in this document, specify use 170 of CryptoPro key meshing algorithm, except for id- 171 Gost28147-89-TestParamSet, which specifies use of null key meshing 172 algorithm. 174 2.3.1 Null Key Meshing 176 A null key meshing algorithm never changes a key. It's OID is: 178 id-Gost28147-89-None-KeyMeshing OBJECT IDENTIFIER ::= 179 { id-CryptoPro-algorithms keyMeshing(14) none(0) } 181 This algorithm has NULL parameters. 183 2.3.2 CryptoPro Key Meshing 185 CryptoPro key meshing algorithm transforms the key and initialization 186 vector every 1KB of plaintext data. It's OID is: 188 id-Gost28147-89-CryptoPro-KeyMeshing OBJECT IDENTIFIER ::= 189 { id-CryptoPro-algorithms keyMeshing(14) cryptoPro(1) } 191 This algorithm has NULL parameters. 193 Encryption or decryption starts with key K[0] = K, IV0[0] = IV, i = 194 0. Let IV[0] be the value of initialization vector after processing 195 1K of data. Encryption or decryption of next 1K data block will start 196 with K[1] and IV0[1], which are calculated using formula: 198 K[i+1] = decryptECB (K[i], C); 199 IV0[i+1] = encryptECB (K[i+1],IV[i]) 201 Where C = {0x69, 0x00, 0x72, 0x22, 0x64, 0xC9, 0x04, 0x23, 202 0x8D, 0x3A, 0xDB, 0x96, 0x46, 0xE9, 0x2A, 0xC4, 203 0x18, 0xFE, 0xAC, 0x94, 0x00, 0xED, 0x07, 0x12, 204 0xC0, 0x86, 0xDC, 0xC2, 0xEF, 0x4C, 0xA9, 0x2B}; 206 After processing every next 1K block, current initialization vector 207 is stored as IV[i+1], i is incremented and the same transformation 208 applied. 210 3 HMAC_GOSTR3411 212 HMAC_GOSTR3411 (K,text) function is based on hash function GOST R 213 34.11-94, as defined in [HMAC], with the following parameter values: 214 B = 32, L = 32. 216 4 PRF_GOSTR3411 218 PRF_GOSTR3411 is a pseudorandom function, based on HMAC_GOSTR3411. 219 It is calculated as P_hash, defined in section 5 of [TLS]. 220 PRF_GOSTR3411(K,D) = P_GOSTR3411 (K,D) 222 5 Key Derivation Algorithms 224 Standards [GOSTR341094] and [GOSTR34102001] do not define any key 225 derivation algorithms. 227 Section 5.1 specifies algorithm VKO GOST R 34.10-94, which generates 228 GOST KEK using two GOST R 34.10-94 keypairs. 230 Section 5.2 specifies algorithm VKO GOST R 34.10-2001, which 231 generates GOST KEK using two GOST R 34.10-2001 keypairs, and 232 synchrovector A. 234 Keypairs MUST have identical parameters. 236 5.1 VKO GOST R 34.10-94 238 This algorithm creates a a key encryption key (KEK) using sender's 239 private key and recipient public key, or vice versa. 241 Exchange key EK is a 256-bit hash of 1024-bit Diffie-Hellman key 242 K(x,y); 244 1. Let K(x,y) = a^(x*y) (mod p), where 245 x - sender's private key, a^x - sender's public key 246 y - recipient's private key, a^y - recipient's public key 247 a, p - parameters 2. Calculate a 256-bit hash of K(x,y): 248 KEK(x,y) = gostR3411 (K(x,y)) 250 Keypairs x and y MUST comply with [GOSTR341094]. 252 This algorithm MUST NOT be used, when a^x = a (mod p) or a^y = a (mod 253 p). 255 5.2 VKO GOST R 34.10-2001 257 This algorithm creates a key encryption key (KEK) using synchrovector, 258 sender's private key and recipient public key, or vice versa. 260 1. Let K(x,y,IV) = ((IV*x)(mod q)) . (y.P) (512 bit), where 261 x - sender's private key (256 bit) 262 x.P - sender's public key (512 bit) 263 y - recipient's private key (256 bit) 264 y.P - recipient's public key (512 bit) 265 IV - synchrovector (64 bit) 266 P - base point on the elliptic curve (two 256-bit coordinates) 267 IV*x - x multiplied by IV as integers 268 x.P - a multiple point 270 2. Calculate a 256-bit hash of K(x,y,IV): 271 KEK(x,y,IV) = gostR3411 (K(x,y,IV)) 273 Keypairs x and y MUST comply with [GOSTR34102001]. 275 This algorithm MUST NOT be used, when x.P = P, y.P = P 277 6 Key Wrap algorithms 279 This document defines two key wrap algorithms: GOST 28147-89 Key Wrap 280 and CryptoPro Key Wrap. 282 6.1 GOST 28147-89 Key Wrap 284 This algorithm encrypts GOST 28147-89 CEK with a GOST 28147-89 KEK. 286 Note: This algorithm MUST NOT be used with KEK produced by VKO GOST R 287 34.10-94, because such KEK is constant for every sender-recipient 288 pair. Encrypting many different content encryption keys on the same 289 constant KEK may reveal this KEK. 291 Identifier for this algorithm: 293 id-Gost28147-89-None-KeyWrap OBJECT IDENTIFIER ::= 294 { id-CryptoPro-algorithms keyWrap(13) none(0) } 296 The GOST 28147-89 key wrap algorithm is: 298 1. For unique symmetric KEK, generate 8 octets at random, 299 call the result IV. 300 For KEK, produced by VKO GOST R 34.10-2001, use the same IV, 301 that was used for key derivation. 302 2. Compute a 4-byte checksum value, gost28147IMIT (IV, KEK, CEK), 303 call the result CEK_MAC. 304 3. Encrypt CEK in ECB mode using KEK. Use IV, generated in step 1. 305 Call the ciphertext CEK_ENC. 306 4. Let RES = IV | CEK_ENC | CEK_MAC. 308 6.2 GOST 28147-89 Key Unwrap 310 This algorithm decrypts GOST 28147-89 CEK with a GOST 28147-89 KEK. 311 The GOST 28147-89 key unwrap algorithm is: 313 1. If the wrapped content-encryption key is not 44 octets, then 314 error. 315 2. Decompose the the wrapped content-encryption key into IV, CEK_ENC 316 and CEK_MAC. IV is the most significant (first) 8 octets, CEK_ENC 317 is next 32 octets, and CEK_MAC is the least significant (last) 4 318 octets. 319 3. Decrypt CEK_ENC in ECB mode using KEK. Use IV, obrained in 320 step 1. Call the output CEK. 321 4. Compute a 4-byte checksum value, gost28147IMIT (IV, KEK, CEK), 322 compare the result CEK_MAC. If not equal, then error. 324 6.3 CryptoPro Key Wrap 326 This algorithm encrypts GOST 28147-89 CEK with a GOST 28147-89 KEK. 327 It can be used with any KEK, e.g. produced by VKO GOST R 34.10-94 or 328 VKO GOST R 34.10-2001, because unique initialization vector is used 329 to diversify the KEK. 331 Identifier for this algorithm: 333 id-Gost28147-89-CryptoPro-KeyWrap OBJECT IDENTIFIER ::= 334 { id-CryptoPro-algorithms keyWrap(13) cryptoPro(1) } 336 The CryptoPro key wrap algorithm is: 338 1. For unique symmetric KEK, or KEK produced by VKO GOST R 34.10-94, 339 generate 8 octets at random, call the result IV. 340 For KEK, produced by VKO GOST R 34.10-2001, use the same IV, 341 that was used for key derivation. 342 2. Diversify KEK, using CryptoPro KEK Diversification Algorithm, 343 described in section 7.2.1, call the result KEK(IV); 344 3. Compute a 4-byte checksum value, 345 gost28147IMIT (IV, KEK(IV), CEK), call the result CEK_MAC. 346 4. Encrypt CEK in ECB mode using KEK(IV). Use IV, generated in 347 step 1. 348 Call the ciphertext CEK_ENC. 349 5. Let RES = IV | CEK_ENC | CEK_MAC. 351 6.4 CryptoPro Key Unrap 353 This algorithm encrypts GOST 28147-89 CEK with a GOST 28147-89 KEK. 354 The CryptoPro key unwrap algorithm is: 356 1. If the wrapped content-encryption key is not 44 octets, then 357 error. 358 2. Decompose the the wrapped content-encryption key into IV, CEK_ENC 359 and CEK_MAC. IV is the most significant (first) 8 octets, CEK_ENC 360 is next 32 octets, and CEK_MAC is the least significant (last) 361 4 octets. 362 3. Diversify KEK, using CryptoPro KEK Diversification Algorithm, 363 described in section 6.5, call the result KEK(IV); 364 4. Decrypt CEK_ENC in ECB mode using KEK(IV). Use IV, obrained in 365 step 1. Call the output CEK. 366 5. Compute a 4-byte checksum value, 367 gost28147IMIT (IV, KEK(IV), CEK), compare the result CEK_MAC. 368 If not equal, then error. 370 6.5 CryptoPro KEK Diversification Algorithm 372 Given a random 64-bit synchrovector IV, and a GOST 28147-89 key K, 373 this algorithm creates a new GOST 28147-89 key K(IV). 375 1. Let K[0] = K; 377 2. IV is split into components a[i,j]: 378 IV = a[0]|...|a[7] (a[i] - byte, a[i,0]..a[i,7] - it's bits) 380 3. Let i be 0. 382 4. K[1]..K[8] are calculated by repeating the 383 following algorithm eight times: 385 A) K[i] is split into components k[i,j]: 386 K[i] = k[i,0]|k[i,1]|...|k[i,7] (k[i,j] - 32-bit integer) 387 B) Vector S[i] is calculated: 388 S[i] = ((a[i,0]*k[i,0] + ... + a[i,7]*k[i,7]) mod 2^32) 389 | ((~a[i,0]*k[i,0] + ... + ~a[i,7]*k[i,7]) mod 2^32); 390 C) K[i+1] = encryptCFB (S[i], K[i], K[i]) 391 D) i = i + 1 393 5. Let K(IV) be K[8]. 395 7 Secret Key Diversification 397 This algorithm creates a GOST 28147-89 key Kd, given GOST R 34.10-94 398 or GOST R 34.10-2001 secret key K and diversification data D of size 399 4..40 bytes. 401 1) 40-byte blob B is created from D by cloning it enough times to 402 fill all 40 bytes. For example, if D is 40-bytes long, B = D; If D is 403 4-bytes long, B = D|D|D|D|D|D|D|D|D|D. 405 2) B is split into 8-byte SV and 32-byte SRCKEY (B = SV|SRCKEY). 407 3) Algorithm from section 6.5 is used to create K(SV) from key K and 408 synchrovector SV, with two differences. Instead of S[i], vector 409 (0,0,0,SV[i],ff,ff,ff,ff XOR SV[i]) is used, and during each 410 encryption step, only 8 out of 32 GOST 28147-89 steps are done. 412 4) Kd is calculated: 413 Kd = encryptCFB (IV, K(IV), SRCKEY). 415 8 Algorithm parameters 417 Standards [GOST28147], [GOST341194], [GOSTR341094] and 418 [GOSTR34102001] do not define specific values for algorithm 419 parameters. 421 This document introduces the use of OIDs to specify algorithm 422 parameters. 424 Identifiers and corresponding parameter values for all of the 425 proposed parameter sets can be found in Appendix in the form of ASN.1 426 modules [X.660]. 428 8.1 Encryption algorithm parameters 430 GOST 28147-89 can be used in several modes, additional CBC mode is 431 defined in section 2.1 this document. It also has an S-Box parameter 432 (see Algorithm Parameters part in [GOST28147] in Russian, description 433 in English see in [Schneier95] ch. 14.1, p. 331). 435 This table contains the list of proposed parameter sets for GOST 436 28147-89: 438 Gost28147-89-ParamSetAlgorithms ALGORITHM-IDENTIFIER ::= { 439 { Gost28147-89-ParamSetParameters IDENTIFIED BY 440 id-Gost28147-89-TestParamSet } | 441 { Gost28147-89-ParamSetParameters IDENTIFIED BY 442 id-Gost28147-89-CryptoPro-A-ParamSet } | 443 { Gost28147-89-ParamSetParameters IDENTIFIED BY 444 id-Gost28147-89-CryptoPro-B-ParamSet } | 445 { Gost28147-89-ParamSetParameters IDENTIFIED BY 446 id-Gost28147-89-CryptoPro-C-ParamSet } | 447 { Gost28147-89-ParamSetParameters IDENTIFIED BY 448 id-Gost28147-89-CryptoPro-D-ParamSet } | 449 { Gost28147-89-ParamSetParameters IDENTIFIED BY 450 id-Gost28147-89-CryptoPro-Simple-A-ParamSet } | 451 { Gost28147-89-ParamSetParameters IDENTIFIED BY 452 id-Gost28147-89-CryptoPro-Simple-B-ParamSet } | 453 { Gost28147-89-ParamSetParameters IDENTIFIED BY 454 id-Gost28147-89-CryptoPro-Simple-C-ParamSet } | 455 { Gost28147-89-ParamSetParameters IDENTIFIED BY 456 id-Gost28147-89-CryptoPro-Simple-D-ParamSet } 457 } 459 Identifier values can be found in Appendix. 461 Parameters for GOST 28147-89 are presented in the following form: 463 Gost28147-89-ParamSetParameters ::= SEQUENCE { 464 eUZ Gost28147-89-UZ, 465 mode INTEGER { 466 gost28147-89-CNT(0), 467 gost28147-89-CFB(1), 468 cryptoPro-CBC(2) 469 }, 470 shiftBits INTEGER { gost28147-89-block(64) }, 471 keyWrap AlgorithmIdentifier, 472 keyMeshing AlgorithmIdentifier 473 } 474 Gost28147-89-UZ ::= OCTET STRING (SIZE (64)) 475 Gost28147-89-KeyMeshingAlgorithms ALGORITHM-IDENTIFIER ::= { 476 { NULL IDENTIFIED BY id-Gost28147-89-CryptoPro-KeyMeshing } | 477 { NULL IDENTIFIED BY id-Gost28147-89-None-KeyMeshing } 478 } 479 Gost28147-89-KeyWrapAlgorithms ALGORITHM-IDENTIFIER ::= { 480 { NULL IDENTIFIED BY id-Gost28147-89-CryptoPro-KeyWrap } | 481 { NULL IDENTIFIED BY id-Gost28147-89-None-KeyWrap } 482 } 484 where 485 eUZ - S-box value; 486 mode - cipher mode; 487 shiftBits - cipher parameter; 488 keyWrap - key export algorithm identifier; 489 keyMeshing - key meshing algorithm identifier. 491 8.2 Digest algorithm parameters 493 This table contains the list of proposed parameter sets for 494 [GOST341194]: 496 GostR3411-94-ParamSetAlgorithms ALGORITHM-IDENTIFIER ::= { 497 { GostR3411-94-ParamSetParameters IDENTIFIED BY 498 id-GostR3411-94-TestParamSet 499 } | 500 { GostR3411-94-ParamSetParameters IDENTIFIED BY 501 id-GostR3411-94-CryptoProParamSet 502 } 503 } 505 Identifier values can be found in Appendix. 507 Parameters for [GOST341194] are presented in the following form: 509 GostR3411-94-ParamSetParameters ::= 510 SEQUENCE { 511 hUZ Gost28147-89-UZ, -- S-Box for digest 512 h0 GostR3411-94-Digest -- start digest value 513 } 514 GostR3411-94-Digest ::= OCTET STRING (SIZE (32)) 516 6.3 GOST R 34.10-94 public key algorithm parameters 518 This table contains the list of proposed parameter sets for GOST R 519 34.10-94: 521 GostR3410-94-ParamSetAlgorithm ALGORITHM-IDENTIFIER ::= { 522 { GostR3410-94-ParamSetParameters IDENTIFIED BY 523 id-GostR3410-94-TestParamSet } | 524 { GostR3410-94-ParamSetParameters IDENTIFIED BY 525 id-GostR3410-94-CryptoPro-A-ParamSet } | 526 { GostR3410-94-ParamSetParameters IDENTIFIED BY 527 id-GostR3410-94-CryptoPro-B-ParamSet } | 528 { GostR3410-94-ParamSetParameters IDENTIFIED BY 529 id-GostR3410-94-CryptoPro-C-ParamSet } | 530 { GostR3410-94-ParamSetParameters IDENTIFIED BY 531 id-GostR3410-94-CryptoPro-D-ParamSet } | 532 { GostR3410-94-ParamSetParameters IDENTIFIED BY 533 id-GostR3410-94-CryptoPro-XchA-ParamSet } | 534 { GostR3410-94-ParamSetParameters IDENTIFIED BY 535 id-GostR3410-94-CryptoPro-XchB-ParamSet } | 536 { GostR3410-94-ParamSetParameters IDENTIFIED BY 537 id-GostR3410-94-CryptoPro-XchC-ParamSet } 538 } 540 Identifier values can be found in Appendix. 542 Parameters for GOST R 34.10-94 are presented in the following form: 544 GostR3410-94-ParamSetParameters ::= 545 SEQUENCE { 546 p INTEGER, 547 q INTEGER, 548 a INTEGER, 549 validationAlgorithm AlgorithmIdentifier {{ 550 GostR3410-94-ValidationAlgorithms 551 }} OPTIONAL 552 } 554 GostR3410-94-ValidationParameters ::= 555 SEQUENCE { 556 t INTEGER, 557 x0 INTEGER, 558 c INTEGER, 559 d INTEGER OPTIONAL 560 } 562 Where 563 p - modulus, prime number, 2^1023