Re: [MMUSIC] draft-4572-update: Spec contains references to a number of obsoleted RFCs

[Christer Holmberg <[e-mail]>]

Ok, I’ll submit a new version (-10) based on the changes below.

Regards,

Christer

From: Roman Shpount [mailto:[e-mail]]
Sent: 04 January 2017 16:31
To: Christer Holmberg <[e-mail]>
Cc: Martin Thomson <[e-mail]>; Cullen Jennings <[e-mail]>; Jonathan Lennox <[e-mail]>; [e-mail]
Subject: Re: [MMUSIC] draft-4572-update: Spec contains references to a number of obsoleted RFCs

This looks good to me

_____________
Roman Shpount

On Wed, Jan 4, 2017 at 6:22 AM, Christer Holmberg <[e-mail]<mailto:[e-mail]>> wrote:
Ok, to make sure we are all on the same page, below are the places in the previous version (-08) of the draft where MD2 and MD5 are mentioned, and my suggestion on what/if to do:


Section 5:
-------------

"hash-func              =  "sha-1" / "sha-224" / "sha-256" /
                             "sha-384" / "sha-512" /
                             "md5" / "md2" / token
                             ; Additional hash functions can only come
                             ; from updates to RFC 3279"

Christer's suggestion: Keep the text as it is.

-------------

   "Following RFC 3279 [7] as updated by RFC 4055 [9], therefore, the
   defined hash functions are 'SHA-1' [1] [18], 'SHA-224' [1], 'SHA-256'
   [1], 'SHA-384'[1], 'SHA-512' [1], 'MD5' [4], and 'MD2' [3], with
   'SHA-256' preferred.  A new IANA registry of Hash Function Textual
   Names, specified in Section 8, allows for addition of future tokens,
   but they may only be added if they are included in RFCs that update
   or obsolete RFC 3279 [7]."

Christer's suggestion: Keep the text, but update the MD2 and MD5 references ([3] and [4]), and add the following new paragraph text:

"For backward compatibility with implementations compliant with RFC 4572, the MD2 and MD5 cipher suite are still listed in the syntax. However, implementations compliant to this specification MUST NOT use them."


Section 8:
-------------

"Table 1 contains the initial values of this registry.

        +--------------------+------------------------+-----------+
        | Hash Function Name |          OID           | Reference |
        +--------------------+------------------------+-----------+
        |       "md2"        |   1.2.840.113549.2.2   |  RFC 3279 |
        |       "md5"        |   1.2.840.113549.2.5   |  RFC 3279 |
        |      "sha-1"       |     1.3.14.3.2.26      |  RFC 3279 |
        |     "sha-224"      | 2.16.840.1.101.3.4.2.4 |  RFC 4055 |
        |     "sha-256"      | 2.16.840.1.101.3.4.2.1 |  RFC 4055 |
        |     "sha-384"      | 2.16.840.1.101.3.4.2.2 |  RFC 4055 |
        |     "sha-512"      | 2.16.840.1.101.3.4.2.3 |  RFC 4055 |
        +--------------------+------------------------+-----------+"

Christer's suggestion: Keep the above text, without changes. This is the initial IANA registration, and we don't change that.


Regards,

Christer




-----Original Message-----
From: Martin Thomson [mailto:[e-mail]<mailto:[e-mail]>]
Sent: 04 January 2017 00:07
To: Roman Shpount <[e-mail]<mailto:[e-mail]>>
Cc: Cullen Jennings <[e-mail]<mailto:[e-mail]>>; Jonathan Lennox <[e-mail]<mailto:[e-mail]>>; [e-mail]<mailto:[e-mail]>; Christer Holmberg <[e-mail]<mailto:[e-mail]>>
Subject: Re: [MMUSIC] draft-4572-update: Spec contains references to a number of obsoleted RFCs

On 4 January 2017 at 04:44, Roman Shpount <[e-mail]<mailto:[e-mail]>> wrote:
> I agree, I think MD2 and MD5 should be defined in the grammar but
> specification should state that they MUST NOT be used. This way there
> are no potential backwards interop problems.

To address Christer's original concern, I would say that you don't need a reference to the algorithms to achieve that.  An informative reference is as far as you might go.