Re: [MMUSIC] Alissa Cooper's No Objection on draft-ietf-mmusic-4572-update-12: (with COMMENT)

I am for removing the text.

_____________
Roman Shpount

On Wed, Feb 1, 2017 at 3:18 PM, Christer Holmberg <
christer.holmberg@ericsson.com> wrote:

> Does anyone object to deleting the text? Martin? Ekr? Roman? Cullen?
>
> Regards,
>
> Christer
>
> -----Original Message-----
> From: Alissa Cooper [mailto:alissa@cooperw.in]
> Sent: 01 February 2017 22:15
> To: Christer Holmberg <christer.holmberg@ericsson.com>
> Cc: IESG <iesg@ietf.org>; draft-ietf-mmusic-4572-update@ietf.org;
> Flemming Andreasen <fandreas@cisco.com>; mmusic-chairs@ietf.org;
> mmusic@ietf.org
> Subject: Re: Alissa Cooper's No Objection on draft-ietf-mmusic-4572-update-12:
> (with COMMENT)
>
>
> > On Feb 1, 2017, at 3:04 PM, Christer Holmberg <
> christer.holmberg@ericsson.com> wrote:
> >
> > Hi Alissa,
> >
> > Thank you for your review! See below.
> >
> > ----------------------------------------------------------------------
> > COMMENT:
> > ----------------------------------------------------------------------
> >
> >> Section 5.1 says:
> >>
> >> "An endpoint MAY, in addition to its more preferred hash function,
> >> also verify that each certificate used matches fingerprints
> >> calculated using other hash functions.  Unless there is a matching
> >> fingerprint for each tested hash function, the endpoint MUST NOT
> >> establish the TLS connection."
> >>
> >> This seems a little weird to me. It's up to the endpoint to decide
> >> whether to check for errors, and then if it does find an error it
> >> can't setup the connection, whereas if it just hadn't checked it would
> be able to setup the connection. I think it would help to explain why an
> endpoint would be motivated to check multiple fingerprints.
> >
> > I think the only use-case that came up was a situation where the
> receiver is not sure which hash function is the "strongest", and therefor
> checks multiple. However, it was also realized that with the multiple set
> of hash functions such situation is very unlikely to occur.
> >
> > So, I could add the following note:
> >
> > "NOTE: An endpoint might choose to match each used certificate against
> > fingerprints calculated using multiple hash functions e.g, if the
> endpoint is unsure which hash function is the strongest."
> >
> > ...or we could simply delete the text. I personally would go for that,
> but in case others want to keep it I have no problem with that.
>
> It would make more sense to me to delete it but either solution would be
> an improvement I think.
>
> Thanks,
> Alissa
>
> >
> > Regards,
> >
> > Christer
> >
> >
>
> _______________________________________________
> mmusic mailing list
> mmusic@ietf.org
> https://www.ietf.org/mailman/listinfo/mmusic
>