Re: [Cfrg] erratum for hmac what do we think...

[Michael StJohns <[e-mail]>]

On 2/3/2017 1:28 PM, Stephen Farrell wrote:
> Thanks all,
>
> My reading of that thread leads me to conclude there there's consensus
> to not verify the erratum on the basis that the threat isn't that
> significant and a backwards incompatible change as would be required is
> not justified. However, if HMAC were to be updated in a manner that
> didn't require backwards compatibility then one would likely consider
> this. Hence I've marked this as "hold for document update"

I'd like to reiterate that RFC 2104 (or substantially similar text) was 
a feeder/submission for the FIPS 198-1 standard.  Its also old enough 
that it doesn't have the boilerplate we've since added that would allow 
for any changes/errata.  In that mode, its similar to the original 
publications of PKCS1, 7 and 12 as informational RFCs and we required a 
grant of rights to be able to gain change control over them.

Instead of making changes here to a document that's been OBEd by first 
being published as a FIPS  (FIPS 198) and second by an update in 2008 
(FIPS 198-1), let me suggest that comments should be bundled up and 
addressed to that document instead.

It looks like FIPS 198 is up for review in 2018 and changes might be 
applied then.

Perhaps I'm wrong about this, but we - the IETF - do not own change 
control over every RFC.

Mike


>
> Cheers,
> S.
>
> On 02/02/17 02:24, Stephen Farrell wrote:
>> Hiya,
>>
>> There's an erratum posted for hmac [1] where I'd be
>> interested in what folks here think.
>>
>> I'm unsure if this is a real problem, esp given that
>> there are I guess a lot of implementations.
>>
>> And even if it were a real problem, I'm not sure we'd
>> want that fix.
>>
>> Opinions welcome...
>>
>> Thanks,
>> S.
>>
>> [1]
>> https://www.rfc-editor.org/errata_search.php?rfc=2104&eid=4809&rec_status=15&area_acronym=&errata_type=&wg_acronym=&submitter_name=&stream_name=&submit_date=&presentation=records
>>
>>
>>
>> _______________________________________________
>> Cfrg mailing list
>> [e-mail]
>> https://www.irtf.org/mailman/listinfo/cfrg
>>
>
>
> _______________________________________________
> Cfrg mailing list
> [e-mail]
> https://www.irtf.org/mailman/listinfo/cfrg