PGI spec: add supported algorithms section

[woodruffw]

WIP; flagging some questions/discussion topics below 🙂

This is my attempt to make progress on the question of "what algorithms should a client support/need to support to interoperate with the public good instance?"

xrefs:

• specs: add algorithm-registry.md #42
• Clarifications on cryptographic agility and versions protobuf-specs#566
• [META] Cryptographic agility for Sigstore clients and services sig-clients#16

[woodruffw]

Flagging: I added this legend to make the table below easier to follow, but I could also see it possibly making things more confusing (or too messy with the emojis); curious what others think!

[kommendorkapten]

The changes looks good, thanks for doing this @woodruffw

One question I have

• For client interoperability, I understand this as ecdsa-sha2-256-nistp256 is the only algorithm now that's guaranteed for work for all clients? We have talked about having ecdsa-sha2-384-nistp384 and ecdsa-sha2-512-nistp521 as required algorithms too (and Ed25519 for Rekor V2). Will this be added later or did I misunderstand something? If we start with only one algorithm as required to reflect the current state, then give clients time to upgrade, that's fine. I'm asking as if we should cut a new release of the Sigstore bundle that looks down the required set of algorithms, listing P384 and P521 is preferable.

[haydentherapper]

I wonder if we need another section before that summarizes the intersection of all required algorithms across the services, which would be ecdsa-sha2-256-nistp256, ecdsa-sha2-384-nistp384, and ed25519.

[woodruffw]

@kommendorkapten

• For client interoperability, I understand this as ecdsa-sha2-256-nistp256 is the only algorithm now that's guaranteed for work for all clients?

Yeah, I think positively speaking ecdsa-sha2-256-nistp256 is the only algorithm that's guaranteed to consistently work for all clients. ecdsa-sha2-256-nistp384 (i.e. one of the weird pairings) also typically works for all clients, since it's currently tested via the conformance suite (although of course we'll want to hard-forbid that with the next bundle version).

Normatively speaking IMO ecdsa-sha2-256-nistp256, ecdsa-sha2-384-nistp384, ecdsa-sha2-512-nistp521, and ed25519 should all be required in conforming clients. I just didn't include that since it isn't the status quo 🙂

TL;DR: I think what we should do here is:

1. Land a positive description of what currently works and is required
2. Lock down v4 bundles with the normative description of what's required/forbidden, and then update here

How does that sound?

---

@haydentherapper

I wonder if we need another section before that summarizes the intersection of all required algorithms across the services, which would be ecdsa-sha2-256-nistp256, ecdsa-sha2-384-nistp384, and ed25519.

I can add that! Are you thinking that makes sense in the PGI doc?

[haydentherapper]

I can add that! Are you thinking that makes sense in the PGI doc?

I was thinking we'd add that to this doc. Your second point covers that though, that we'll revisit this with a v4 bundle spec update.

[kommendorkapten]

How does that sound?

Perfect, that is what I think we should do, as it was what we discussed in sigstore/protobuf-specs#566

Just wanted to make sure we're all aligned 🙌