Re: [Cfrg] erratum for hmac what do we think...

[Stephen Farrell <[e-mail]>]

On 03/02/17 19:49, Michael StJohns wrote:
> On 2/3/2017 1:28 PM, Stephen Farrell wrote:
>> Thanks all,
>>
>> My reading of that thread leads me to conclude there there's consensus
>> to not verify the erratum on the basis that the threat isn't that
>> significant and a backwards incompatible change as would be required is
>> not justified. However, if HMAC were to be updated in a manner that
>> didn't require backwards compatibility then one would likely consider
>> this. Hence I've marked this as "hold for document update"
> 
> I'd like to reiterate that RFC 2104 (or substantially similar text) was
> a feeder/submission for the FIPS 198-1 standard.  Its also old enough
> that it doesn't have the boilerplate we've since added that would allow
> for any changes/errata.  In that mode, its similar to the original
> publications of PKCS1, 7 and 12 as informational RFCs and we required a
> grant of rights to be able to gain change control over them.
> 
> Instead of making changes here to a document that's been OBEd by first
> being published as a FIPS  (FIPS 198) and second by an update in 2008
> (FIPS 198-1), let me suggest that comments should be bundled up and
> addressed to that document instead.
> 
> It looks like FIPS 198 is up for review in 2018 and changes might be
> applied then.
> 
> Perhaps I'm wrong about this, but we - the IETF - do not own change
> control over every RFC.

I don't think we need worry about process nits like that tbh. The
distinction between a rejected erratum, a hold-for-document-update
erratum and an erratum that's been posted but ignored for 6 months
isn't really of interest:-)

I would worry a bit about it if we approved an erratum that broke
interop, which we could have done, but didn't do, in this case.

And if/when someone wants to revise hmac then I hope they do talk
with the IETF about that. Most, but not all, RFCs that use that do
support alg agility so there could be done potential breakage to
consider.

S.


> 
> Mike
> 
> 
>>
>> Cheers,
>> S.
>>
>> On 02/02/17 02:24, Stephen Farrell wrote:
>>> Hiya,
>>>
>>> There's an erratum posted for hmac [1] where I'd be
>>> interested in what folks here think.
>>>
>>> I'm unsure if this is a real problem, esp given that
>>> there are I guess a lot of implementations.
>>>
>>> And even if it were a real problem, I'm not sure we'd
>>> want that fix.
>>>
>>> Opinions welcome...
>>>
>>> Thanks,
>>> S.
>>>
>>> [1]
>>> https://www.rfc-editor.org/errata_search.php?rfc=2104&eid=4809&rec_status=15&area_acronym=&errata_type=&wg_acronym=&submitter_name=&stream_name=&submit_date=&presentation=records
>>>
>>>
>>>
>>>
>>> _______________________________________________
>>> Cfrg mailing list
>>> [e-mail]
>>> https://www.irtf.org/mailman/listinfo/cfrg
>>>
>>
>>
>> _______________________________________________
>> Cfrg mailing list
>> [e-mail]
>> https://www.irtf.org/mailman/listinfo/cfrg
> 
> 
> 
> 
> 
> _______________________________________________
> Cfrg mailing list
> [e-mail]
> https://www.irtf.org/mailman/listinfo/cfrg
>