Re: [MMUSIC] Stephen Farrell's Discuss on draft-ietf-mmusic-4572-update-12: (with DISCUSS)

[Christer Holmberg <[e-mail]>]

Ok. Thanks! :)

On 01/02/17 11:23, "Stephen Farrell" <[e-mail]> wrote:

>
>
>On 01/02/17 08:43, Christer Holmberg wrote:
>> Hi Stephen,
>> 
>> Are you happy with the responses you have received?
>
>I'm always happy:-) Will send a substantive (positive)
>response later, will be afk for a bit this morning
>
>S
>
>> 
>> Regards,
>> 
>> Christer
>> 
>> 
>> On 01/02/17 10:09, "Stephen Farrell" <[e-mail]> wrote:
>> 
>>>
>>>
>>> On 01/02/17 07:18, Eric Rescorla wrote:
>>>> On Tue, Jan 31, 2017 at 5:08 PM, Stephen Farrell
>>>> <[e-mail]>
>>>> wrote:
>>>>
>>>>> Stephen Farrell has entered the following ballot position for
>>>>> draft-ietf-mmusic-4572-update-12: Discuss
>>>>>
>>>>> When responding, please keep the subject line intact and reply to all
>>>>> email addresses included in the To and CC lines. (Feel free to cut
>>>>>this
>>>>> introductory paragraph, however.)
>>>>>
>>>>>
>>>>> Please refer to
>>>>> https://www.ietf.org/iesg/statement/discuss-criteria.html
>>>>> for more information about IESG DISCUSS and COMMENT positions.
>>>>>
>>>>>
>>>>> The document, along with other ballot positions, can be found here:
>>>>> https://datatracker.ietf.org/doc/draft-ietf-mmusic-4572-update/
>>>>>
>>>>>
>>>>>
>>>>> 
>>>>>----------------------------------------------------------------------
>>>>> DISCUSS:
>>>>> 
>>>>>----------------------------------------------------------------------
>>>>>
>>>>>
>>>>> I've two (or 4 depending how you count:-) things
>>>>> I'd like to check here. Should be pretty easy to
>>>>> handle.
>>>>>
>>>>> (1) section 5: I'm wondering if we have the right
>>>>> set of hash functions here. Deprecating md2 and md5
>>>>> is great, but I have a bunch of questions about the
>>>>> others:
>>>>>
>>>>> (1.1) why not also say that sha-1 MUST NOT be used
>>>>> for new things (or similar)?
>>>>>
>>>>> (1.2) do you really need sha-224 and 384? I think
>>>>> nobody uses those at all.
>>>>>
>>>>
>>>> It's certainly not correct that nobody uses SHA-384.
>>>>
>>>> In fact, for TLS 1.3, you can't sign anything with P-384 without using
>>>> SHA-384.
>>>
>>> Fair enough. I guess some p384 will be seen in the web just
>>> because it'll be seen as longer/stronger with tls1.3.
>>>
>>> S
>>>
>>>>
>>>> -Ekr
>>>>
>>>>
>>>>> (1.3) I'm a bit surprised you didn't add sha3 (and
>>>>> maybe remove sha-512 if that's not needed) Even if
>>>>> you don't encourage use of sha3, it might be good
>>>>> to include it in the abnf now in case it gets
>>>>> popular.
>>>>>
>>>>> (2) Wouldn't it be a good plan to say that TLS
>>>>> as-used MUST conform to BCP195? If not, why not?
>>>>>
>>>>>
>>>>>
>>>>>
>>>>> _______________________________________________
>>>>> mmusic mailing list
>>>>> [e-mail]
>>>>> https://www.ietf.org/mailman/listinfo/mmusic
>>>>>
>>>>
>>>
>