Re: [dnsext] Report from chairs

[Phillip Hallam-Baker <[e-mail]>]

My feeling is that we should shelve this and instead work on a key
exchange to compliment TSIG and then deprecate HMAC-MD5 for use in
that context.

The reason for this is that I think DNS-CURVE meets a real need, even
if the approach is not really sensitive to existing DNS code.
Suggesting a move to ECC is a good idea, suggesting transport layer
security is a good idea. Suggesting both in the same proposal is not.

For example, most enterprises use split DNS. They do not want their
internal DNS to be externally visible. But if (like me) the only
corporate facility you really need most of the time is email, you can
get perfectly adequate support by using SMTP and IMAP/POP over SSL.
Using IPSEC just to secure the DNS part is really quite painful. This
approach is much cleaner.


So given that we can expect to upgrade the whole TSIG area in an
important way, and given that there is no immediate security risk with
MD5, I think it makes sense to have one transition rather than two.


On Mon, Jul 26, 2010 at 3:10 AM, Francis Dupont
<[e-mail]> wrote:
>  In your previous mail you wrote:
>
>   4.  EXPIRED DRAFTS
>
>       - draft-ietf-dnsext-tsig-md5-deprecated
>
>   Is anyone still interested in this draft?  We have no movement on it.
>
> => there is a clear lack of support for this draft. I propose to give
> the question to the security area so they should say if it is fine to
> keep MD5 mandatory in an IETF protocol.
>
> Two comments:
>  - MD5 is used in a way (HMAC) it is not proved to be weak
>
>  - the issue is MD5 it is forbidden for most (i.e., all I know of :-)
>  certified cryptos so it is not possible to run a both certified (for
>  the crypto) and conformant (to standards) TSIG tool.
>  Now it seems to be only a formal concern...
>
> Thanks
>
> [e-mail]
>
>



-- 
Website: http://hallambaker.com/