Re: [DNSOP] RFC 2845bis and HMAC-MD5
Matthew Pounsett <matt@conundrum.com> Thu, 14 March 2019 18:56 UTC
Return-Path: <matt@conundrum.com>
X-Original-To: dnsop@ietfa.amsl.com
Delivered-To: dnsop@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 18BDF130ED9 for <dnsop@ietfa.amsl.com>; Thu, 14 Mar 2019 11:56:43 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.899
X-Spam-Level:
X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_MED=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=conundrum-com.20150623.gappssmtp.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Vbin4S1O_KEI for <dnsop@ietfa.amsl.com>; Thu, 14 Mar 2019 11:56:41 -0700 (PDT)
Received: from mail-io1-xd34.google.com (mail-io1-xd34.google.com [IPv6:2607:f8b0:4864:20::d34]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 1DF86130EAE for <dnsop@ietf.org>; Thu, 14 Mar 2019 11:56:40 -0700 (PDT)
Received: by mail-io1-xd34.google.com with SMTP id k21so6042056ior.13 for <dnsop@ietf.org>; Thu, 14 Mar 2019 11:56:40 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=conundrum-com.20150623.gappssmtp.com; s=20150623; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=D3AEe+dVSMFvN0g76X5edNKU8TIytfQVA/9gJCM3OOo=; b=UOG0tyA+5ZcF66/jqOd6Em97ZnrW3+rGWSceoVbIKHJBLjEu0JBbXPj9/yyD4or48p yN3lm8KZPUsMzSU6I4QPQGvxQrVz+IF8saYPc8sJhRT4bV9sAOqsOvD4d1HFH2is6B7d N51L7VFwA2AhqskLP6e7KvYISzSoMgdoU3ze1g6nyA5zZ8Ra2PdRQZN7XmDR+NZ3yyrp fUPTVTytsyielvYSUb+56jXYKq3hVSMDv189p5XlQR7v8ntGsvV2UbmTlDd2+lDNdOAh H0NGQABM9aY5OpDnJuMIBVoGCrqVXI1w5vaorMCrVNHvAZzSPwDgDwDlC2Mj+kQdT+UY Gssg==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=D3AEe+dVSMFvN0g76X5edNKU8TIytfQVA/9gJCM3OOo=; b=cUVmSK1Y304iUvp9ae+x6kMrZHH9ymxoXzj4+D1evsLsw/9DPIbmLxuZhE+JBij+2p e/w99H0S2bYdPONX+vZhtu0KmqKv9OkcNpnvyJAizqR6cICUHluVoQzSwhLWIEUwklgY iyBXXUd0lAd62bqkYo3TBmR6IP5V+gEYTKCHVepLfXrT8SAKzrnnDIHQlv+19k/OCwwb 4QsFLUya1TPDWvmjglWXWMBK008+5j4u7wSvQMhF1ps6ppOtLijFNoUHQAV+Oqn1iOjk LRhlXsORDLrKEn4SfKpZx2ungDV6sA7mdLXaA7fxw6UL0NLBTwap1YYkeE+gRWXsZ09X 27cw==
X-Gm-Message-State: APjAAAXwCHIN+KAYFJsxQlzRz+N7lDjlVC9Y5lNkhAB14zojGH6k1Krm FpiVvlWKg9lZY5iUssxBDZyMq+nvx3Rp56q/15GjOEZblbU=
X-Google-Smtp-Source: APXvYqysUtO1ZHc7EFer+qzGyqx7dCBlQ4yPhVFEHOEt4oplRw6rExHojGqBCxfpMxXIEvi4CPJvxqVjuxp1CU0ggBA=
X-Received: by 2002:a6b:ec15:: with SMTP id c21mr18767866ioh.152.1552589800136; Thu, 14 Mar 2019 11:56:40 -0700 (PDT)
MIME-Version: 1.0
References: <20190314155324.4841ce29@glaurung.nlnetlabs.nl> <alpine.DEB.2.20.1903141507190.13313@grey.csi.cam.ac.uk>
In-Reply-To: <alpine.DEB.2.20.1903141507190.13313@grey.csi.cam.ac.uk>
From: Matthew Pounsett <matt@conundrum.com>
Date: Thu, 14 Mar 2019 14:56:29 -0400
Message-ID: <CAAiTEH80z9B7xcpmppJ=QJ6NQUwROXBMdJDwfLmczw3+EfCiCw@mail.gmail.com>
To: Tony Finch <dot@dotat.at>
Cc: Martin Hoffmann <martin@opennetlabs.com>, dnsop <dnsop@ietf.org>
Content-Type: multipart/alternative; boundary="0000000000008500eb0584127b0c"
Archived-At: <https://mailarchive.ietf.org/arch/msg/dnsop/YaEJ0W2jhXLm6pq4o1VVJYFr-zI>
Subject: Re: [DNSOP] RFC 2845bis and HMAC-MD5
X-BeenThere: dnsop@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: IETF DNSOP WG mailing list <dnsop.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/dnsop>, <mailto:dnsop-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/dnsop/>
List-Post: <mailto:dnsop@ietf.org>
List-Help: <mailto:dnsop-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/dnsop>, <mailto:dnsop-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 14 Mar 2019 18:56:43 -0000
On Thu, 14 Mar 2019 at 11:08, Tony Finch <dot@dotat.at> wrote: > Martin Hoffmann <martin@opennetlabs.com> wrote: > > > > As such, I would like to propose to move HMAC-MD5 to optional and only > > retain SHA-1 and SHA-256 as mandatory. > > That seems sensible. There should at the very least be a reference to > RFC6151, Updated Security Considerations for the MD5 Message-Digest and > the HMAC-MD5 Algorithms. > Agreed. I can't remember the last time I generated an HMAC-MD5 key .. and I believe the default behaviour for most (all?) recent major distributions default to something stronger (e.g. BIND now defaults to HMAC-SHA256). Any operators needing to support old key algorithms would be free to use distributions that continue to optionally support them, or generate and distribute new keys (something that should be done periodically anyway).
- [DNSOP] RFC 2845bis and HMAC-MD5 Martin Hoffmann
- Re: [DNSOP] RFC 2845bis and HMAC-MD5 Tony Finch
- Re: [DNSOP] RFC 2845bis and HMAC-MD5 Matthew Pounsett
- Re: [DNSOP] RFC 2845bis and HMAC-MD5 Dick Franks
- Re: [DNSOP] RFC 2845bis and HMAC-MD5 Paul Wouters
- Re: [DNSOP] RFC 2845bis and HMAC-MD5 Tony Finch