MIME-Version: 1.0
References: 
 <172816120099.282330.5360535206284650774@dt-datatracker-cb674fff7-jr9km>
 <CABcZeBOvNVQS6ajKvWogbyHNKr_gS0eW6830knsjvMTdDbfrgA@mail.gmail.com>
 <1be35104-c7d4-45d3-8dd3-ddcdf7ec6a0c@betaapp.fastmail.com>
In-Reply-To: <1be35104-c7d4-45d3-8dd3-ddcdf7ec6a0c@betaapp.fastmail.com>
From: Rob Sayre <sayrer@gmail.com>
Date: Sun, 13 Oct 2024 15:53:40 -0700
Message-ID: 
 <CAChr6SwaxS3uwYBw73J=VtvM8=suG+89LCmmiUkFNEDcJ8otNw@mail.gmail.com>
To: Martin Thomson <mt@lowentropy.net>
Content-Type: multipart/alternative; boundary="0000000000000f2bed062463988f"
Message-ID-Hash: BQH5BCGHAUB6MQJVUB62AAORINYDCJV3
CC: Eric Rescorla <ekr@rtfm.com>,
 "barryleiba@gmail.com Leiba" <barryleiba@computer.org>, art@ietf.org,
 draft-eastlake-fnv.all@ietf.org, last-call@ietf.org
Precedence: list
Subject: =?utf-8?q?=5Bart=5D_Re=3A_=5BLast-Call=5D_Artart_last_call_review_of_draft-e?=
	=?utf-8?q?astlake-fnv-28?=
Archived-At: 
 <https://mailarchive.ietf.org/arch/msg/art/Smo95ww1W4i2mHlS6Fi5s2yzi8g>

--0000000000000f2bed062463988f
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

On Sun, Oct 13, 2024 at 3:39=E2=80=AFPM Martin Thomson <mt@lowentropy.net> =
wrote:

> On Sun, Oct 13, 2024, at 10:23, Eric Rescorla wrote:
> > IMO the IESG should decline to publish this document.
>
> In my opinion also.
>

Yeah. That seems right to me, but shouldn't the "Security Considerations"
cover the attacks in

https://en.wikipedia.org/wiki/Fowler=E2=80=93Noll=E2=80=93Vo_hash_function

"The Python programming language previously used a modified version of the
FNV scheme for its default hash function. From Python 3.4, FNV has been
replaced with SipHash to resist 'hash flooding' denial-of-service attacks."

We do internet protocols here in the IETF, so I think those attacks are
salient to the IETF mission. FNV seems like a good choice for internal data
structures (not IETF territory). But no objection to documenting it on the
Independent stream.

thanks,
Rob

--0000000000000f2bed062463988f
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><div dir=3D"ltr">On Sun, Oct 13, 2024 at 3:39=E2=80=AFPM M=
artin Thomson &lt;<a href=3D"mailto:mt@lowentropy.net">mt@lowentropy.net</a=
>&gt; wrote:<br></div><div class=3D"gmail_quote"><blockquote class=3D"gmail=
_quote" style=3D"margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left=
-style:solid;border-left-color:rgb(204,204,204);padding-left:1ex">On Sun, O=
ct 13, 2024, at 10:23, Eric Rescorla wrote:<br>
&gt; IMO the IESG should decline to publish this document.<br>
<br>
In my opinion also.<br></blockquote><div><br></div><div>Yeah. That seems ri=
ght to me, but shouldn&#39;t the &quot;Security Considerations&quot; cover =
the attacks in</div><div><br></div><div><a href=3D"https://en.wikipedia.org=
/wiki/Fowler%E2%80%93Noll%E2%80%93Vo_hash_function">https://en.wikipedia.or=
g/wiki/Fowler=E2=80=93Noll=E2=80=93Vo_hash_function</a><br></div><div><br><=
/div><div>&quot;The Python programming language previously used a modified =
version of the FNV scheme for its default hash function. From Python 3.4, F=
NV has been replaced with SipHash to resist &#39;hash flooding&#39; denial-=
of-service attacks.&quot;</div><div><br></div><div>We do internet protocols=
 here in the IETF, so I think those attacks are salient to the IETF mission=
. FNV seems like a good choice for internal data structures (not IETF terri=
tory). But no objection to documenting it on the Independent stream.</div><=
div><br></div><div>thanks,</div><div>Rob</div><div><br></div></div></div>

--0000000000000f2bed062463988f--