Re: Stephen Farrell's Discuss on draft-ietf-6man-stable-privacy-addresses-16: (with DISCUSS and COMMENT)

[Fernando Gont <[e-mail]>]

On 01/21/2014 03:12 PM, Stephen Farrell wrote:
>>> They are just examples. I guess we could add HMAC-SHA256, too. I have no
>>> objections to that.
>>
>> On all the platforms I know there would be no practical reason to pick
>> MD5. Something better is always available and just as easy to use. I
>> don't want new code to use MD5 "because it was given as an example in
>> the RFC". Removing MD5 from the examples list would make me happy.
> 
> Right - give good examples and don't give bad ones is the
> easy fix. HMAC-SHA1 and HMAC-SHA256 would be good ones to
> give. (And if you have sha1 then you can easily use HMAC-SHA1.)

Ok. If you know of the URLs for the proper references, please do let me
know.


>>>> (2) Why might a sys admin want to display the
>>>> secret key?
>>>
>>> e.g., you want a replacement system to generate the same addresses.
>>
>> Good reason IMHO.
> 
> Was that mentioned in the requirements? 

I will check :-)



> If keeping it, I'd say give the example and then add a
> security consideration that that interface might be
> vulnerable (e.g. 'cat /proc/net/eth0/rfcxxx-secret'

How about rather noting that the secret key should only be accessible by
the system administrator? (i.e., non-RFC2119 recommend that implementers
do the right thing :-) )

Thanks!

Best regards,
-- 
Fernando Gont
SI6 Networks
e-mail: [e-mail]
PGP Fingerprint: 6666 31C6 D484 63B2 8FB1 E3C4 AE25 0D55 1D4E 7492