Re: [OPSEC] minutes part 2

On  16 Dec 2008, at 19:20, Glen Kent wrote:
> I don't understand your concern.

I have no concern with the WG documenting any issues, provided:
- they really are technical issues rather than opinion,
- the analysis really is comprehensive, including a threat model,
- the analysis also discusses existing mitigations,
and
- the analysis covers all such authentication mechanism,
   including for example RFC-2154, not just some of them.

(For an individual submission rather than a WG document, of course,
none of the above caveats would apply, as individuals can say
whatever they wish, true or not, in a personal informational RFC. :-)

As my notes have tried (and perhaps failed, sigh) to make
clear, the focus of my concerns are:

1) An apparent proposal, according to the WG minutes, to have
    the OPsec WG recommend that users migrate to using SHA-based
    mechanisms.  There are not solid technical grounds to
    recommend/prefer SHA approaches over MD5 approaches
    (or the reverse: it isn't obvious that MD5 is better either).

2) Erroneous claims in the meeting minutes that SHA-based approaches
    are better than the existing MD5-based mechanisms.  The approaches
    are very slightly different, but as the URLs I provided much earlier
    today make clear, SHA has issues in the published literature just
    as MD5 does, AND NIST is actively moving to deprecate SHA/SHA-1/ 
SHA-2.

Yours,

Ran
rja@extremenetworks.com

_______________________________________________
OPSEC mailing list
OPSEC@ietf.org
https://www.ietf.org/mailman/listinfo/opsec