RE: Authentication

["Gray, Eric" <[e-mail]>]

Dave,

	Is it actually the case that the IESG will not allow
the document to advance without requiring SHA-1, or is it
the case that we either mandate it or we define the security
and/or trust environment in which it is, or is not, required?

	One could make the case that authentication is not 
required for devices that are not directly exposed to the
big I.  In such devices, it could also be the case that
realistic authentication is unlikely to be feasible. In
that case, and assuming that making an attempt to provide
authentication that is even approximately realistic has a
non-zero cost - even if it is never turned on - why would
we want to mandate authentication for such devices?

--
Eric

-----Original Message-----
From: [e-mail] [mailto:[e-mail]]On
Behalf Of Dave Katz
Sent: Thursday, March 17, 2005 1:29 PM
To: Chris Nogradi
Cc: [e-mail]
Subject: Re: Authentication



On Mar 17, 2005, at 7:08 AM, Chris Nogradi wrote:

> Dave,
>
> I just noticed that you have added the following sentence to the base 
> draft in
> section 6.6:
>
> "Implementations MUST support SHA1 authentication.  Other froms of
> authentication are optional."
>
> Since you did not make mention of this in the document changes 
> sections, I
> assume that this does not mean that all implementations must support 
> at least
> this form of authentication.  Is the purpose of this sentence to say 
> that if
> an implementation uses authentication, it must support SHA1?

Sorry, I forgot to list that in the changes.

This is in there because the IESG will not allow the document to 
advance without it.  It's an interesting question as to whether they 
would allow the spec to say that an implementation could have no 
authentication at all;  my guess is that their stand is that the spec 
must require that all implementations support SHA1 authentication.

I also expect that vendors will make their own choices, as there is no 
significant difference between an implementation in which nobody turns 
on authentication and an implementation that does not even include it.

But that's the word from on high.

>
> BTW, there is a typo in this sentence as it should say "forms" instead 
> of
> "froms".

Thanks...

--Dave