Re: [OPSEC] minutes part 2

["Glen Kent" <[e-mail]>]

This does not address the point that i had raised.

> I have no concern with the WG documenting any issues, provided:
> - they really are technical issues rather than opinion,

So, you dont think the issues mentioned in the drafts are technical?
OK, how would you categorize those issues?

> - the analysis really is comprehensive, including a threat model,
> - the analysis also discusses existing mitigations,
> and
> - the analysis covers all such authentication mechanism,
>  including for example RFC-2154, not just some of them.

Its experimental. Lets leave it out of the discussion.

>
> (For an individual submission rather than a WG document, of course,
> none of the above caveats would apply, as individuals can say
> whatever they wish, true or not, in a personal informational RFC. :-)
>
> As my notes have tried (and perhaps failed, sigh) to make
> clear, the focus of my concerns are:
>
> 1) An apparent proposal, according to the WG minutes, to have
>   the OPsec WG recommend that users migrate to using SHA-based

Can you stop being vague and mention the precise proposal you are
arguing against?

>   mechanisms.  There are not solid technical grounds to
>   recommend/prefer SHA approaches over MD5 approaches
>   (or the reverse: it isn't obvious that MD5 is better either).

So, you dont think there is any value in moving over to SHA based
mechanisms, is it?

>
> 2) Erroneous claims in the meeting minutes that SHA-based approaches
>   are better than the existing MD5-based mechanisms.  The approaches
>   are very slightly different, but as the URLs I provided much earlier
>   today make clear, SHA has issues in the published literature just

You probably did not notice, but IESG has added a note, in the very
RFC (4822) where YOU have added support for SHA for RIP

"In the interests of encouraging rapid migration away from Keyed-MD5
and its known weakness, the IESG has approved this document even
though it does not meet the guidelines in BCP 107 (RFC 4107)."

Glen
_______________________________________________
OPSEC mailing list
[e-mail]
https://www.ietf.org/mailman/listinfo/opsec