Re: [Cfrg] What crypto algorithm is referenced most in RFCs?

[Stephen Farrell <[e-mail]>]

On 18/06/11 20:09, Marshall Eubanks wrote:
> On Sat, Jun 18, 2011 at 2:48 PM, Stephen Farrell
> <[e-mail]>wrote:
> 
>>
>>
>> On 18 Jun 2011, at 19:33, Marshall Eubanks <[e-mail]>
>> wrote:
>>
>>
>>
>> On Fri, Jun 17, 2011 at 3:14 PM, Stephen Farrell <<[e-mail]>
>> [e-mail]> wrote:
>>
>>> Seems like a reasonable idea but defining the "we" that are
>>> noticing/sending this might be tricky. We don't want IETF WGs to start
>>> complaining about the IRTF CFRG crypto police. People can be touchy about
>>> stuff like that. I'm not sure how best that'd be done to be honest.
>>>
>>>
>> Write an I-D along the lines of "MD-5 considered dangerous" and get it
>> published.
>>
>>
>> RFC6151?
>>
> 
> I thought that there was something like this. Then quote this
> 
>    MD5 is no longer acceptable where collision resistance is required
>    such as digital signatures.  It is not urgent to stop using MD5 in
>    other ways, such as HMAC-MD5; however, since MD5 must not be used for
>    digital signatures, new protocol designs should not employ HMAC-MD5.
> 
> 
> and point out how the new I-D disagrees with it.
> 
> That's not being the Crypto police. After all, the IESG approved this RFC
> and new use of MD5 should get pushback when an I-D gets to the IESG.
> Pointing this out earlier is just saving people's time, and ADs generally
> appreciate having their time saved.

Sure, I'm all for it if its not perceived as adding bureaucracy.
Don't forget we already have up to 6 reviews etc. on stuff at
last-call time.

If someone has a way to generate a report identifying relevant
-00 and -01 drafts maybe, and someone else is willing to ping
authors and explain when they then say "so what" that might
be good.

I'd say a concrete proposal for what and how to do it, sent to
this list (and then probably saag) for sanity checking would
be good. So, who's stepping up to figure out details for such
a proposal?

S.


> 
> Regards
> Marshall
> 
> 
>> S
>>
>>
>> Regards
>> Marshall
>>
>>
>>
>>
>>> S
>>>
>>> On 17 Jun 2011, at 19:40, David McGrew < <[e-mail]>
>>> [e-mail]> wrote:
>>>
>>>>
>>>> On Jun 17, 2011, at 11:29 AM, David McGrew wrote:
>>>>
>>>>> Hi Joachim,
>>>>>
>>>>> +1 on the idea of making sure that current I-Ds that mention MD5 are
>>> aware   Probably this could be done by crafting a short paragraph saying
>>> something like "We noticed that your RFC references MD5;
>>>>
>>>> aargh, I meant "your I-D references MD5".
>>>>
>>>> David
>>>> _______________________________________________
>>>> Cfrg mailing list
>>>> <[e-mail]>[e-mail]
>>>> <http://www.irtf.org/mailman/listinfo/cfrg>
>>> http://www.irtf.org/mailman/listinfo/cfrg
>>> _______________________________________________
>>> Cfrg mailing list
>>>  <[e-mail]>[e-mail]
>>>  <http://www.irtf.org/mailman/listinfo/cfrg>
>>> http://www.irtf.org/mailman/listinfo/cfrg
>>>
>>
>>
>