Re: [Pals] Kathleen Moriarty's Discuss on draft-ietf-pals-p2mp-pw-03: (with DISCUSS)

[Kathleen Moriarty <[e-mail]>]

Hi Stewart,

Thanks for your response.  Inline.

On Thu, Aug 31, 2017 at 8:02 AM, Stewart Bryant
<[e-mail]> wrote:
>
>
> On 30/08/2017 20:29, Kathleen Moriarty wrote:
>>
>> Kathleen Moriarty has entered the following ballot position for
>> draft-ietf-pals-p2mp-pw-03: Discuss
>>
>> When responding, please keep the subject line intact and reply to all
>> email addresses included in the To and CC lines. (Feel free to cut this
>> introductory paragraph, however.)
>>
>>
>> Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html
>> for more information about IESG DISCUSS and COMMENT positions.
>>
>>
>> The document, along with other ballot positions, can be found here:
>> https://datatracker.ietf.org/doc/draft-ietf-pals-p2mp-pw/
>>
>>
>>
>> ----------------------------------------------------------------------
>> DISCUSS:
>> ----------------------------------------------------------------------
>>
>> I haven't sen a response to the SecDir review, so please point me to one
>> if
>> there has been a response.  I fully agree with Tero that MD5 is not
>> adequate
>> and hasn't been for some time.  What is the plan to rectify this and
>> deprecate
>> use of the TCP MD5 signature for LDP? RFC8077, says that LDP MD5
>> authentication
>> key option as described in the section 2.9 of RFC5036 MUST be implemented.
>> I
>> asked on my ballot for RFC8077 when a deprecation process would start in
>> support of Stephen's abstain and would like an update on that process.
>>
>> https://mailarchive.ietf.org/arch/msg/secdir/ga2pIVcGw9WEgBX5MXA9MCmSs_s
>>
>>
>>
>>
>
> Hi Kathleen,
>
> I have proposed some text that tells implementers and operators that MD5 is
> inadequate and that they should be prepared for an upgraded default hash for
> LDP. I don't think we do any more at this stage.

OK, I'll look out for the text.  Thanks.

>
> I have just spoken to Loa, one of the MPLS chairs, and we have agreed to
> write a short draft within the next month to start the process of
> deprecating MD5 and selecting and standardizing a new default hash for LDP.
> We will discuss this draft with the MPLS WG via the MPLS list and at the
> next IETF.

That is very helpful, thank you.  Alvaro mentioned some of the
challenges, reminding of past discussions on this topic.  Would it be
helpful to engage security/crypto folks at routing vendors who would
be familiar with the challenges?  I'm thinking this could be helpful
to get recommendations and a transition plan that takes everything
into account that's needed for a successful transition.
>
> Best Regards
>
> Stewart
>



-- 

Best regards,
Kathleen