Re: [dnsext] WGLC TSIG MD5 Deprecated

[Federico Lucifredi <[e-mail]>]

[ Moderators note: Post was moderated, either because it was posted by
   a non-subscriber, or because it was over 20K.  
   With the massive amount of spam, it is easy to miss and therefore 
   delete relevant posts by non-subscribers. 
   Please fix your subscription addresses. ]

The document looks good overall, and I support it to go forward in the
adoption process.

The only relevant bit that stands out is the absence of "why" from the
doc. It may have some political reason, but it simply is bad practice in
my view. Point 1 states:

"   When the MD5 [RFC1321] security came to be considered lower than
   expected, [RFC4635] standardized new TSIG algorithms based on SHA
   [RFC3174][RFC3874][RFC4634] digests.

   But [RFC4635] did not deprecate the HMAC-MD5 algorithm."

So, there is implicitly a reason to now go back and degrade MD5's status
to optional. I know the papers, you know the papers. Something should be
said here to explain why we are doing this -- or, if there is no reason,
 we should not be doing it.

Just so that it is clear, I _do_ support the change. I think we should
explain why, however, with something along the thought line of "as
research is progressively weakening MD5's cryptographic strength, it is
now time to allocate mandatory status to algorithms not as of yet so
compromised".

I do not like (6), which goes in the opposite direction. We are doing
this because we believe there is a reason to, are we? :

"6. Security Considerations


   This document does not assume anything about the cryptographic
   security of different hash algorithms.  Its purpose is a better
   availability of some security mechanisms in a predictable time frame."


The second statement is good, the first not so much. Again, we are
trying to allocate mandatory status to algorithms that are not as far
down the process of being compromised... there may be  nicer way to put
it, but someone reading the doc should be able to understand why this is
done without outside knowledge of MD5's progressive weakening.


 This is my only correction, but I feel pretty strongly that the doc
should explain /why/ it is doing /what/ it is doing.

 Best -F


Olafur Gudmundsson wrote:
> 
> Please someone take few minutes to say you have read the document,
> and your impression of it document !!
> 
> I'm extending the LC until June 10'th,
> IF we do not have 5 reviews by then the document will be killed!!!!!
> 
>         Olafur
> 
> 
> At 12:31 20/05/2009, Ólafur Guðmundsson /DNSEXT wrote:
>> Reminder
>> we still need more reviews.
>>
>> In particular none of the people that supported adoption has
>> submitted one.
>>
>>         Olafur
>>
>> Ps: in case you forgot if you supported the document (and agreed to
>> review)
>> Roy Arends, Mark Andrews, Olaf Kolkman, Patrik Fältström, Joe Abley,
>> Brian Dickson, Edward Lewis, Mike StJohns
>>
>> At 18:19 08/05/2009, Ólafur Guðmundsson /DNSEXT wrote:
>>
>>> This note starts a Working Group Last Call for this Standards Track
>>> document
>>> ending on midnight May 24'th UTZ 2009.
>>>
>>> URL for the document and its history:
>>> http://tools.ietf.org/wg/dnsext/draft-ietf-dnsext-tsig-md5-deprecated/
>>>
>>> This document is on the Standards Track,  The document updates
>>> standards track
>>> documents and redefines an IANA registry.
>>>
>>> Please read the document carefully, and send your comments to the
>>> mailing list.
>>>
>>> The document process rules in this working group, require that at least
>>> 5 members of the working to state that they have reviewed the document
>>> and there is consensus of support to publish it as a Standards Track
>>> RFC.
>>>
>>>         Olafur (for the chairs)
>>>
>>>
>>>
>>> -- 
>>> to unsubscribe send a message to [e-mail] with
>>> the word 'unsubscribe' in a single line as the message text body.
>>> archive: <http://ops.ietf.org/lists/namedroppers/>
>>
>>
>> -- 
>> to unsubscribe send a message to [e-mail] with
>> the word 'unsubscribe' in a single line as the message text body.
>> archive: <http://ops.ietf.org/lists/namedroppers/>
> 
> 
> -- 
> to unsubscribe send a message to [e-mail] with
> the word 'unsubscribe' in a single line as the message text body.
> archive: <http://ops.ietf.org/lists/namedroppers/>


-- 
_________________________________________
-- "'Problem' is a bleak word for challenge" - Richard Fish
(Federico L. Lucifredi) - [e-mail] - GnuPG 0x4A73884C

--
to unsubscribe send a message to [e-mail] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>