Re: [saag] draft-iab-crypto-alg-agility-00

[Stephen Kent <[e-mail]>]

Ben,
> On 7 April 2014 18:54, Stephen Kent <[e-mail]> wrote:
>> Ben,
>>
>> Sorry to jump on late on this, but as a co-author of an RFC that deals
>> with alg agility for the RPKI, I thought I might be able to contribute.
>>
>> It's generally useful to have a MUST implement alg (or set, if there are
>> multiple
>> algs needed) for any set of protocols (data formats, etc.) to help ensure
>> interoperability. Selecting the MUST implement is sometimes hard, but it's
>> worth
>> the effort.
>>
>> Then one needs to have a way for all clients, CA, and log servers (in the CT
>> context)
>> to express which alg9s) are being used at any time, so that everyone else
>> knows
>> what choices have been made, when choices are allowed, and to guide folks
>> through the
>> transition process.
> I am not really arguing with that, actually. But in the case of CT,
> this information needs to be in the metadata about the logs. The RFC
> does not currently specify how that metadata becomes available to
> clients (and I'm not sure it should, either).

Is that really the only option, i.e., externally-distributed alg info?

I worry that this will be a problem. The RFC really needs to address this.

Steve