Re: [MMUSIC] Aligning RFC 4572 and draft-dtls-sdp regarding preferred SHA cipher?

[Roman Shpount <[e-mail]>]

On Thu, Feb 25, 2016 at 4:51 AM, Christer Holmberg <
[e-mail]> wrote:

> RFC 4572 (tls-sdp) contains the following text:
>
>
>
> “Following RFC 3279 [7] as updated by RFC
>
>               4055 [9], therefore, the defined hash functions are 'SHA-1'
> [11]
>
>               [19], 'SHA-224' [11], 'SHA-256' [11], 'SHA-384' [11],
> 'SHA-512' [11],
>
>               'MD5' [12], and 'MD2' [13], with 'SHA-1' preferred.”
>
>
>
> Draft-dtls-sdp contains the following text:
>
>
>
> “Endpoints MUST support SHA-256 for generating and verifying the
> fingerprint
>
>                value associated with the DTLS association. The use of
> SHA-256 is preferred.”
>
>
>
> I.e. for TLS SHA-1 is preferred, and for DTLS SHA-256 is preferred.
>
>
>
> Martin suggested (I assume) that we should update RFC 4572, to make
> SHA-256 preferred also for TLS.
>
>
>
> Assuming we do the update, I guess the updated 4572 text would say:
>
>
>
> “Following RFC 3279 [7] as updated by RFC
>
>               4055 [9], therefore, the defined hash functions are 'SHA-1'
> [11]
>
>               [19], 'SHA-224' [11], 'SHA-256' [11], 'SHA-384' [11],
> 'SHA-512' [11],
>
>               'MD5' [12], and 'MD2' [13], with 'SHA-256' preferred.”
>
>
>
>
>
> Q1:        Do people agree to updating the preferred cipher in 4572?
>
>
>
> Q3:        IF(Q1) Should the update be done within draft-dtls-sdp, or
> should we create a separate draft/milestone for it?
>
>
>
I think the has function preference should be updated in 4572. I would
prefer a separate draft for RFC 4572 update. There are enough issues with
RFC 4572, including handling of multiple fingerprints, that justify a
complete rewrite of TLS SDP negotiation procedures. If it would be decided
that RFC 4572 should be updated in draft-dtls-sdp (not my preference), I
would prefer to extend the draft to cover SDP for DTLS and TLS, so that it
obsoletes RFC 4572 instead of patching it.

Regards,
_____________
Roman Shpount