Re: [OPSEC] draft-bhatia-manral-igp-crypto-requirements

Hi Glen,

Thanks for your support of the document.

There was no ambiguity as such, however Ran wanted us to look further
into whether the recently announced vulnerabilities to SHA-1 and MD5
would effect the reccomendation for HMAC-SHA-1.

Thanks,
Vishwas

On Tue, Feb 24, 2009 at 9:04 AM, Glen Kent <glen.kent@gmail.com> wrote:
> So was there any ambiguity in recommending HMAC-SHA1 over other
> available options ever?
>
> I re-read the document, found it extremely simple, the recommendations
> look right, found it just to be what OPSEC must own up.
>
> Glen
>
> On Tue, Feb 24, 2009 at 9:39 AM, Vishwas Manral <vishwas.ietf@gmail.com> wrote:
>> Hi folks,
>>
>> We now have got some clear guidance regarding this document from the
>> Security AD's regarding the cryptographic algorithms (Joel has been
>> privy to those mails). The guidance seems to second what Hugo and
>> other cryptographers have been stating all along. The crux of what has
>> been said is:
>>
>> MD5 should not be used for crypto purposes. SHA-1 though stronger is
>> also vulnerable. HMAC-MD5 though not yet vulnerable looks highly
>> suspect and should not be reccomended. HMAC-SHA-1 for now looks ok and
>> can be reccomended. Goinf forward we should try to reccomend the SHA-2
>> family of protocols.
>>
>> With these clear guidances matching what we have in our documents, I
>> would like to ask the working group to look into this document
>> further. We can then look at getting this as a WG document.
>>
>> Thanks,
>> Vishwas
>> _______________________________________________
>> OPSEC mailing list
>> OPSEC@ietf.org
>> https://www.ietf.org/mailman/listinfo/opsec
>>
>