Re: [mpls] I-D Action: draft-nslag-mpls-deprecate-md5-00.txt

Not bad as a stake in the ground, but it raises as many questions as it answers.
Not least among these is the status of TCP-AO implementation without which this
spec is not going to get traction.

You should probably make significant reference to RFC 6952.

Adrian

> -----Original Message-----
> From: I-D-Announce [mailto:i-d-announce-bounces@ietf.org] On Behalf Of
> internet-drafts@ietf.org
> Sent: 23 February 2018 04:53
> To: i-d-announce@ietf.org
> Subject: I-D Action: draft-nslag-mpls-deprecate-md5-00.txt
> 
> 
> A New Internet-Draft is available from the on-line Internet-Drafts
directories.
> 
> 
>         Title           : Deprecating MD5 for LDP
>         Authors         : Loa Andersson
>                           Stewart Bryant
>                           Andrew G. Malis
>                           Deutshe Telekom
>                           George Swallow
> 	Filename        : draft-nslag-mpls-deprecate-md5-00.txt
> 	Pages           : 6
> 	Date            : 2018-02-22
> 
> Abstract:
>    When the MPLS Label Distribution Protocol (LDP) was specified circa
>    1999, there were very strong requirements that LDP should use a
>    cryptographic hash function to sign LDP protocol messages.  MD5 was
>    widely used at that time, and was the obvious choices.
> 
>    However, even when this decision was being taken there were concerns
>    as to whether MD5 was a strong enough signing option.  This
>    discussion was briefly reflected in section 5.1 of RFC 5036 [RFC5036]
>    (and also in RFC 3036 [RFC3036]).
> 
>    Over time it has been shown that MD5 can be compromised.  Thus, there
>    is a concern shared in the security community and the working groups
>    responsible for the development of the LDP protocol that LDP is no
>    longer adequately secured.
> 
>    This document deprecates MD5 as the signing method for LDP messages.
>    The document also selects a future method to secure LDP messages -
>    the choice is TCP-AO.  In addition, we specify that the TBD
>    cryptographic mechanism is to be the default TCP-AO security method.
> 
> 
> The IETF datatracker status page for this draft is:
> https://datatracker.ietf.org/doc/draft-nslag-mpls-deprecate-md5/
> 
> There are also htmlized versions available at:
> https://tools.ietf.org/html/draft-nslag-mpls-deprecate-md5-00
> https://datatracker.ietf.org/doc/html/draft-nslag-mpls-deprecate-md5-00
> 
> 
> Please note that it may take a couple of minutes from the time of submission
> until the htmlized version and diff are available at tools.ietf.org.
> 
> Internet-Drafts are also available by anonymous FTP at:
> ftp://ftp.ietf.org/internet-drafts/
> 
> _______________________________________________
> I-D-Announce mailing list
> I-D-Announce@ietf.org
> https://www.ietf.org/mailman/listinfo/i-d-announce
> Internet-Draft directories: http://www.ietf.org/shadow.html
> or ftp://ftp.ietf.org/ietf/1shadow-sites.txt