Re: [babel] WG Last Call on draft-ietf-babel-hmac

[Dave Taht <[e-mail]>]

I am sufficiently old fashioned to want to wait for two interoperable
implementations and some field deployment experience before finalizing
this document. I would like key rotation to work, and, although it may
not be right for this document, the key format as expressed to users,
solidified. Treating 0xdeadbeef as a string vs deadbeef as a string
results in very different keys.

Nits:

"The protocol
   is inapplicable in situations where asymmetric keying is required,
   where the trust relationship is partial"

Given my confusion on this I suggest:

"The protocol
   is inapplicable in situations where asymmetric keying is required,
   where the trust relationship per interface is partial"

...

"and it does not require any
   form of persistent storage."

I would just strike this claim, because it does. While in one
embodiment (hnet) it is possible to bootstrap keys, in most others you
need a routing protocol running before you can dynamically ship conf
files or dynamic configuration to the ends of the network.

"per-interface 32-bit
   integer known as the "packet counter" (PC)."

Do we have the blessing of a cryptographer type saying just how secure
this and the nonce and index are? I don't use words like
"invulnerable" lightly, rather I would say the probability is X of Y.
Given the number of fixed, known fields in the shortest possible hello
message...

...

"Every implementation MUST implement HMAC-SHA256
   [RFC6234], and MAY implement other HMAC algorithms.

I think we managed to get blake2s up to a SHOULD in the past weeks. :)

"Every implementation MUST implement HMAC-SHA256
   [RFC6234], SHOULD implement blake2s, and MAY implement other HMAC algorithms.

or

"SHOULD implement two or more IETF-approved HMAC algorithms".

...

"if the PC
      overflows, a new index is generated;"

"*When* the PC overflows", not if.

And overflow + new index generation is one of those things that
implementors MUST test.

I'm not not huge on the word "index", as used throughout, as in most
programming contexts that's usually a 32 bit integer. Secondary Nonce?

...

"can
   be fairly large (up to 192 octets)"

"There MUST be a minimum size defined for the nonce and index of" (go
drinking with a good cryptographer).

Otherwise implementors will use a single byte.

...

7.  IANA Considerations

Has anyone gone to iana so these tlvs can be baked in stone?

...

Toke Hoyland-Jorgensen

do we have utf-8 support in rfcs yet?