Re: [mpls] Kathleen Moriarty's No Objection on draft-ietf-pals-rfc4447bis-05: (with COMMENT)

["BRUNGARD, DEBORAH A" <[e-mail]>]

(I've included the MPLS WG as this is also critical in their work)

Thanks Kathleen (and Stephen) for your comment on the use of MD5.

Reference to use of MD5 is a much larger issue than this RFC for MPLS and PALS.

For the MPLS and PALS groups, it has been the choice as it is the only choice for which we are aware. And it is in the on-going work. For example, in MPLS, there is on-going an update of RFC5036:
https://www.ietf.org/id/draft-ijln-mpls-rfc5036bis-02.txt

It has the following description on MD5:
"RFC 2385 [RFC2385] asserts that MD5 authentication is now considered by some to be too weak for this application.  It also
points out that a similar TCP option with a stronger hashing
algorithm (it cites SHA-1 as an example) could be deployed.  To
our knowledge, no such TCP option has been defined and deployed. However, we note that LDP can use whatever TCP message digest
techniques are available, and when one stronger than MD5 is
specified and implemented, upgrading LDP to use it would be relatively straightforward."

Stephen and Adrian are co-authoring on a draft addressing security aspects of the MPLS data plane, but it does not address the control plane:
https://www.ietf.org/id/draft-ietf-mpls-opportunistic-encrypt-02.txt

If there is work, please let the MPLS and PALS groups know. If there is a plan to deprecate MD5 by the Security Area, please let us know also.

Thanks again,
Deborah


> -----Original Message-----
> From: iesg [mailto:[e-mail]] On Behalf Of Kathleen Moriarty
> Sent: Wednesday, September 28, 2016 4:59 PM
> To: The IESG <[e-mail]>
> Cc: [e-mail]; [e-mail]; draft-
> [e-mail]; [e-mail]; [e-mail]
> Subject: Kathleen Moriarty's No Objection on draft-ietf-pals-rfc4447bis-05:
> (with COMMENT)
> 
> Kathleen Moriarty has entered the following ballot position for
> draft-ietf-pals-rfc4447bis-05: No Objection
> 
> When responding, please keep the subject line intact and reply to all
> email addresses included in the To and CC lines. (Feel free to cut this
> introductory paragraph, however.)
> 
> 
> Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html
> for more information about IESG DISCUSS and COMMENT positions.
> 
> 
> The document, along with other ballot positions, can be found here:
> https://datatracker.ietf.org/doc/draft-ietf-pals-rfc4447bis/
> 
> 
> 
> ----------------------------------------------------------------------
> COMMENT:
> ----------------------------------------------------------------------
> 
> I share Stephen's concerns on the use of MD5 and would like to see a
> deprecation process begin.
>