Re: [Cfrg] What crypto algorithm is referenced most in RFCs?

Stephen Farrell <stephen.farrell@cs.tcd.ie> Sat, 18 June 2011 20:35 UTC

Return-Path: <stephen.farrell@cs.tcd.ie>
X-Original-To: cfrg@ietfa.amsl.com
Delivered-To: cfrg@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3750221F859D for <cfrg@ietfa.amsl.com>; Sat, 18 Jun 2011 13:35:48 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -106.12
X-Spam-Level:
X-Spam-Status: No, score=-106.12 tagged_above=-999 required=5 tests=[AWL=0.479, BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4, USER_IN_WHITELIST=-100]
Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Z7wtkoC8OcnF for <cfrg@ietfa.amsl.com>; Sat, 18 Jun 2011 13:35:47 -0700 (PDT)
Received: from scss.tcd.ie (hermes.cs.tcd.ie [134.226.32.56]) by ietfa.amsl.com (Postfix) with ESMTP id 21B0021F859C for <cfrg@irtf.org>; Sat, 18 Jun 2011 13:35:45 -0700 (PDT)
Received: from localhost (localhost [127.0.0.1]) by hermes.scss.tcd.ie (Postfix) with ESMTP id E9577171C17; Sat, 18 Jun 2011 21:35:41 +0100 (IST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cs.tcd.ie; h= content-transfer-encoding:content-type:in-reply-to:references :subject:mime-version:user-agent:from:date:message-id:received :received:x-virus-scanned; s=cs; t=1308429341; bh=XZs7LxV6iKxBsC O5Lyeajs5fozsLE7aAdYQjBRKyC6E=; b=1qVTuaP5gOto2mBvSrfhn8h4fzBSx8 09ihVhBXOaNZH2H2vGcv0QZ5/VooH05i1yF/kLOn2EYV/N17Rc43VPAgHcY51WIQ cfobsdHeDNDqR4A0d1aDFCMc1NSlV77kKFAEFAtAX+CDOaldNgc0bC7N6m9ripA/ On5AWisNd5TkESy0qXyQen0Kq12cFcZndSH4s2Auk64npgZZMxPPBEQVTCU1pldK jdNplHBK9GgVFKGCj3PHUCkgqFoabESXQmIIFuNuVQ0NOWS8iFn3zY5fGYX/TWGy 5RqWvGVscD8ytli/Y/jFh6jzPUBOGdhIAi3AryCVZqrkVf04RA/Muk5g==
X-Virus-Scanned: Debian amavisd-new at scss.tcd.ie
Received: from scss.tcd.ie ([127.0.0.1]) by localhost (scss.tcd.ie [127.0.0.1]) (amavisd-new, port 10027) with ESMTP id gzcqLTEjzlC0; Sat, 18 Jun 2011 21:35:41 +0100 (IST)
Received: from [10.87.48.10] (unknown [86.42.30.134]) by smtp.scss.tcd.ie (Postfix) with ESMTPSA id EE078171C02; Sat, 18 Jun 2011 21:35:39 +0100 (IST)
Message-ID: <4DFD0C1B.6070909@cs.tcd.ie>
Date: Sat, 18 Jun 2011 21:35:39 +0100
From: Stephen Farrell <stephen.farrell@cs.tcd.ie>
User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.2.17) Gecko/20110424 Lightning/1.0b2 Thunderbird/3.1.10
MIME-Version: 1.0
To: Marshall Eubanks <marshall.eubanks@gmail.com>
References: <4A7C9D3B-70C6-4D14-A5D8-F54D84DBBEA9@cisco.com> <4DF6FCAD.1000704@Strombergson.com> <4DF7E236.3060603@ieca.com> <CF0765AF-383F-423F-A8CC-10AEB4A3E348@callas.org> <4DF8627B.1030702@Strombergson.com> <74993A34-C2B3-4FA9-B27B-557AD0E3F7BB@cisco.com> <DD276523-6F9F-466E-BC85-CD9887920E6E@cisco.com> <6679410D-BF1F-4FE4-95DB-90E542CDBBD9@cs.tcd.ie> <BANLkTinJaBzm5wWTcJW1ArF8F-O78HLGKw@mail.gmail.com> <D256DDF2-6E11-4322-91B2-3F052DB52FE3@cs.tcd.ie> <BANLkTimyLVpTNcB8BoMFgjyfa23ikbt_gQ@mail.gmail.com>
In-Reply-To: <BANLkTimyLVpTNcB8BoMFgjyfa23ikbt_gQ@mail.gmail.com>
X-Enigmail-Version: 1.1.1
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit
Cc: David McGrew <mcgrew@cisco.com>, "cfrg@irtf.org" <cfrg@irtf.org>
Subject: Re: [Cfrg] What crypto algorithm is referenced most in RFCs?
X-BeenThere: cfrg@irtf.org
X-Mailman-Version: 2.1.12
Precedence: list
List-Id: Crypto Forum Research Group <cfrg.irtf.org>
List-Unsubscribe: <http://www.irtf.org/mailman/options/cfrg>, <mailto:cfrg-request@irtf.org?subject=unsubscribe>
List-Archive: <http://www.irtf.org/mail-archive/web/cfrg>
List-Post: <mailto:cfrg@irtf.org>
List-Help: <mailto:cfrg-request@irtf.org?subject=help>
List-Subscribe: <http://www.irtf.org/mailman/listinfo/cfrg>, <mailto:cfrg-request@irtf.org?subject=subscribe>
X-List-Received-Date: Sat, 18 Jun 2011 20:35:48 -0000

On 18/06/11 20:09, Marshall Eubanks wrote:
> On Sat, Jun 18, 2011 at 2:48 PM, Stephen Farrell
> <stephen.farrell@cs.tcd.ie>wrote;wrote:
> 
>>
>>
>> On 18 Jun 2011, at 19:33, Marshall Eubanks <marshall.eubanks@gmail.com>
>> wrote:
>>
>>
>>
>> On Fri, Jun 17, 2011 at 3:14 PM, Stephen Farrell <<stephen.farrell@cs.tcd.ie>
>> stephen.farrell@cs.tcd.ie> wrote:
>>
>>> Seems like a reasonable idea but defining the "we" that are
>>> noticing/sending this might be tricky. We don't want IETF WGs to start
>>> complaining about the IRTF CFRG crypto police. People can be touchy about
>>> stuff like that. I'm not sure how best that'd be done to be honest.
>>>
>>>
>> Write an I-D along the lines of "MD-5 considered dangerous" and get it
>> published.
>>
>>
>> RFC6151?
>>
> 
> I thought that there was something like this. Then quote this
> 
>    MD5 is no longer acceptable where collision resistance is required
>    such as digital signatures.  It is not urgent to stop using MD5 in
>    other ways, such as HMAC-MD5; however, since MD5 must not be used for
>    digital signatures, new protocol designs should not employ HMAC-MD5.
> 
> 
> and point out how the new I-D disagrees with it.
> 
> That's not being the Crypto police. After all, the IESG approved this RFC
> and new use of MD5 should get pushback when an I-D gets to the IESG.
> Pointing this out earlier is just saving people's time, and ADs generally
> appreciate having their time saved.

Sure, I'm all for it if its not perceived as adding bureaucracy.
Don't forget we already have up to 6 reviews etc. on stuff at
last-call time.

If someone has a way to generate a report identifying relevant
-00 and -01 drafts maybe, and someone else is willing to ping
authors and explain when they then say "so what" that might
be good.

I'd say a concrete proposal for what and how to do it, sent to
this list (and then probably saag) for sanity checking would
be good. So, who's stepping up to figure out details for such
a proposal?

S.


> 
> Regards
> Marshall
> 
> 
>> S
>>
>>
>> Regards
>> Marshall
>>
>>
>>
>>
>>> S
>>>
>>> On 17 Jun 2011, at 19:40, David McGrew < <mcgrew@cisco.com>
>>> mcgrew@cisco.com> wrote:
>>>
>>>>
>>>> On Jun 17, 2011, at 11:29 AM, David McGrew wrote:
>>>>
>>>>> Hi Joachim,
>>>>>
>>>>> +1 on the idea of making sure that current I-Ds that mention MD5 are
>>> aware   Probably this could be done by crafting a short paragraph saying
>>> something like "We noticed that your RFC references MD5;
>>>>
>>>> aargh, I meant "your I-D references MD5".
>>>>
>>>> David
>>>> _______________________________________________
>>>> Cfrg mailing list
>>>> <Cfrg@irtf.org>Cfrg@irtf.org
>>>> <http://www.irtf.org/mailman/listinfo/cfrg>
>>> http://www.irtf.org/mailman/listinfo/cfrg
>>> _______________________________________________
>>> Cfrg mailing list
>>>  <Cfrg@irtf.org>Cfrg@irtf.org
>>>  <http://www.irtf.org/mailman/listinfo/cfrg>
>>> http://www.irtf.org/mailman/listinfo/cfrg
>>>
>>
>>
>