Re: [Cfrg] What crypto algorithm is referenced most in RFCs?

On Sat, Jun 18, 2011 at 2:48 PM, Stephen Farrell
<stephen.farrell@cs.tcd.ie>wrote:

>
>
> On 18 Jun 2011, at 19:33, Marshall Eubanks <marshall.eubanks@gmail.com>
> wrote:
>
>
>
> On Fri, Jun 17, 2011 at 3:14 PM, Stephen Farrell <<stephen.farrell@cs.tcd.ie>
> stephen.farrell@cs.tcd.ie> wrote:
>
>> Seems like a reasonable idea but defining the "we" that are
>> noticing/sending this might be tricky. We don't want IETF WGs to start
>> complaining about the IRTF CFRG crypto police. People can be touchy about
>> stuff like that. I'm not sure how best that'd be done to be honest.
>>
>>
> Write an I-D along the lines of "MD-5 considered dangerous" and get it
> published.
>
>
> RFC6151?
>

I thought that there was something like this. Then quote this

   MD5 is no longer acceptable where collision resistance is required
   such as digital signatures.  It is not urgent to stop using MD5 in
   other ways, such as HMAC-MD5; however, since MD5 must not be used for
   digital signatures, new protocol designs should not employ HMAC-MD5.

and point out how the new I-D disagrees with it.

That's not being the Crypto police. After all, the IESG approved this RFC
and new use of MD5 should get pushback when an I-D gets to the IESG.
Pointing this out earlier is just saving people's time, and ADs generally
appreciate having their time saved.

Regards
Marshall

> S
>
>
> Regards
> Marshall
>
>
>
>
>> S
>>
>> On 17 Jun 2011, at 19:40, David McGrew < <mcgrew@cisco.com>
>> mcgrew@cisco.com> wrote:
>>
>> >
>> > On Jun 17, 2011, at 11:29 AM, David McGrew wrote:
>> >
>> >> Hi Joachim,
>> >>
>> >> +1 on the idea of making sure that current I-Ds that mention MD5 are
>> aware   Probably this could be done by crafting a short paragraph saying
>> something like "We noticed that your RFC references MD5;
>> >
>> > aargh, I meant "your I-D references MD5".
>> >
>> > David
>> > _______________________________________________
>> > Cfrg mailing list
>> > <Cfrg@irtf.org>Cfrg@irtf.org
>> > <http://www.irtf.org/mailman/listinfo/cfrg>
>> http://www.irtf.org/mailman/listinfo/cfrg
>> _______________________________________________
>> Cfrg mailing list
>>  <Cfrg@irtf.org>Cfrg@irtf.org
>>  <http://www.irtf.org/mailman/listinfo/cfrg>
>> http://www.irtf.org/mailman/listinfo/cfrg
>>
>
>