Re: [MMUSIC] draft-4572-update: Spec contains references to a number of obsoleted RFCs

I agree, I think MD2 and MD5 should be defined in the grammar but
specification should state that they MUST NOT be used. This way there are
no potential backwards interop problems.

Regards,

_____________
Roman Shpount

On Tue, Jan 3, 2017 at 12:34 PM, Cullen Jennings <fluffy@iii.ca> wrote:

>
> Trivial nit but ...
>
> Actually I don't think you want MD5 treated as a unknown hash, you want
> treated as a known but don't use. If A offers old and bad crypto to B, we
> have B log that such that we can track down and upgrade A. If we got a a
> new unknown cipher call SSHHAA we would not log that as bad crypto because
> we would assume it was new and good.
>
>
> > On Jan 2, 2017, at 11:03 AM, Eric Rescorla <ekr@rtfm.com> wrote:
> >
> > On Mon, Jan 2, 2017 at 2:41 AM, Christer Holmberg <
> christer.holmberg@ericsson.com> wrote:
> > Hi,
> >
> > >We can remove MD2.  MD5 is dead, SHA-1 is in its death throes, but MD2
> is merely a >(bad) memory.
> >
> > So, my suggestion is to remove all references to MD2 (including the
> ABNF) for now, and we'll then see what the security folks say about MD5 and
> SHA-1.
> >
> > Given the threat model here, I think we want to tell people to ignore
> MD* (i.e., treat it as an unknown hash) and to accept SHA-1 (though perhaps
> only temporarily). Accordingly, I propose removing MD2 and MD5 from this
> grammar, but leave SHA-1.
> >
> > -Ekr
> >
> >
> > Regards,
> >
> > Christer
> >
> >
> > On 30 December 2016 at 22:27, Christer Holmberg <
> christer.holmberg@ericsson.com> wrote:
> > > Hi,
> > >
> > >
> > >
> > > Please note the following:
> > >
> > >
> > >
> > > RFC 6149, which obsoletes RFC 1319, makes MD2 historic. Do people have
> > > a problem with that? I assume we’ll end up in trouble with the
> > > security folks if we keep the old RFC…
> > >
> > >
> > >
> > > And, considering MD2 is historic, do we even need to mention it in
> > > draft-4572-update anymore?
> > >
> > >
> > >
> > > Regards,
> > >
> > >
> > >
> > > Christer
> > >
> > >
> > >
> > >
> > >
> > > From: mmusic [mailto:mmusic-bounces@ietf.org] On Behalf Of Christer
> > > Holmberg
> > > Sent: 30 December 2016 11:42
> > > To: mmusic@ietf.org
> > > Cc: Jonathan Lennox (jonathan@vidyo.com) <jonathan@vidyo.com>; Cullen
> > > Jennings (fluffy@iii.ca) <fluffy@iii.ca>
> > > Subject: [MMUSIC] draft-4572-update: Spec contains references to a
> > > number of obsoleted RFCs
> > >
> > >
> > >
> > > Hi,
> > >
> > >
> > >
> > > The idnits check returns the following for draft-4572-update.
> > >
> > >
> > >
> > > ** Obsolete normative reference: RFC 1319 (ref. '3') (Obsoleted by RFC
> > > 6149)
> > >
> > >
> > >
> > >   ** Downref: Normative reference to an Informational RFC: RFC 1321
> (ref.
> > > '4')
> > >
> > >
> > >
> > >   ** Obsolete normative reference: RFC 3280 (ref. '8') (Obsoleted by
> > > RFC
> > > 5280)
> > >
> > >
> > >
> > >   ** Obsolete normative reference: RFC 4234 (ref. '11') (Obsoleted by
> > > RFC
> > >
> > >      5234)
> > >
> > >
> > >
> > >   ** Obsolete normative reference: RFC 4288 (ref. '12') (Obsoleted by
> > > RFC
> > >
> > >      6838)
> > >
> > >
> > >
> > >   ** Obsolete normative reference: RFC 4346 (ref. '13') (Obsoleted by
> > > RFC
> > >
> > >      5246)
> > >
> > >
> > >
> > >   -- Obsolete informational reference (is this intentional?): RFC 2617
> (ref.
> > >
> > >      '15') (Obsoleted by RFC 7235, RFC 7615, RFC 7616, RFC 7617)
> > >
> > >
> > >
> > >   -- Obsolete informational reference (is this intentional?): RFC 3525
> (ref.
> > >
> > >      '20') (Obsoleted by RFC 5125)
> > >
> > >
> > >
> > >   -- Obsolete informational reference (is this intentional?): RFC 3851
> (ref.
> > >
> > >      '22') (Obsoleted by RFC 5751)
> > >
> > >
> > >
> > > The reason for this is that we used RFC 4572 as base, and did not
> > > change/update the references.
> > >
> > >
> > >
> > > I had a look, and I don’t think there should be any issues in
> > > replacing the current RFCs with the new ones. But, please indicate if
> you see any issues.
> > >
> > >
> > >
> > > Regards,
> > >
> > >
> > >
> > > Christer
> > _______________________________________________
> > mmusic mailing list
> > mmusic@ietf.org
> > https://www.ietf.org/mailman/listinfo/mmusic
> >
>
> _______________________________________________
> mmusic mailing list
> mmusic@ietf.org
> https://www.ietf.org/mailman/listinfo/mmusic
>