Re: [Perc] Roman Danyliw's No Objection on draft-ietf-perc-dtls-tunnel-09: (with COMMENT)

["Paul E. Jones" <[e-mail]>]

Roman,

>Thank you to Shawn Emery for the SECDIR review, and to Russ Housley for the
>security related feedback in the GENART review.
>
>** Section 5.4.
>    The Key Distributor MUST match the certificate fingerprint and
>    "external_session_id" received from endpoint's "ClientHello" message
>    with the values received from the SDP transmitted by the endpoint.
>
>Consider adding a reference to RFC8122 to point to the guidance on the SDP
>fingerprint attribute.

Will add.


>** On the topic of relying on the RFC8122 defined hashes, Section 5 allows for
>the possibility of SHA-1 which is now past its prime.  The text there already
>says “Implementations compliant with this specification MUST NOT use the MD2
>and MD5 hash functions to calculate fingerprints or to verify received
>fingerprints that have been calculated using them.”  Likewise, Section 5.1 also
>notes the requirement of at least one of the hashes being SHA-256.  Consider
>saying sometime along the lines of “Implementations using this tunneling
>approach SHOULD NOT use SHA-1 hash functions to calculate or verify
>fingerprints …”

While you're correct that SHA-1 is aging, I would prefer that this 
document not overrule RFC 8122.   Maybe we should update 8122? The 
reality is, though, SHA-1 is still used.  It's also still widely used in 
SRTP deployments.

Paul