Re: [OPSEC] minutes part 2

On  23 Dec 2008, at 13:21, Vishwas Manral wrote:
> One more interesting thing I noticed was that we are reccomending
> HMAC-SHA-1 over Keyed-MD5 for OSPF and RIP do you agree to this part?
>
> Thanks,
> Vishwas
> =====================================================
>
>   For OSPF implementations to interoperate, they must support one or
>   more authentication algorithms in common that can be used in the
>   cryptographic scheme of authentication.
>
>   This section details the authentication algorithm requirements for
>   standards conformant OSPF implementations.
>
>   Old   Old         New
>   Req.  RFC         Requirement  Authentication Algorithm
>   ---   ------      -----------  ------------------------
>   MUST  2328        MUST-        Keyed MD5
>    -     -          SHOULD+      HMAC-SHA-1 [OSPF-HMAC]
>    -     -          MAY+         HMAC-SHA-256/HMAC-SHA-384/HMAC- 
> SHA-512
>

I don't think the current knowledge to hand supports the
policy in the text you've quoted above.

In the past, BEFORE the understanding that SHA has "serious
attacks", then encouraging the use of SHA might have been
widely deemed reasonable, but given the current data
I don't see how one can draw that same conclusion now.

Cheers,

Ran
rja@extremenetworks.com

_______________________________________________
OPSEC mailing list
OPSEC@ietf.org
https://www.ietf.org/mailman/listinfo/opsec