[secdir] Secdir review of draft-turner-md4-to-historic-08

[Catherine Meadows <[e-mail]>]

I have reviewed this document as part of the security directorate's 
ongoing effort to review all IETF documents being processed by the 
IESG.  These comments were written primarily for the benefit of the 
security area directors.  Document editors and WG chairs should treat 
these comments just like any other last call comments.


This document recommends that the MD4 hash algorithm be retired and moved to historic status and gives
the rationale for doing this, namely its known vulnerability to collision and pre-image attacks. The impact is mostly minimal, except
for three Microsoft RFCs that are still supported in various versions of  Windows and the RADIUS and EAP RFCs .  It would be helpful to learn what other algorithms
these OSs and RFCs support.  This would give a better idea of the effect of dropping MD4; if there are other alternatives supported by the OS's
the impact should be minimal here as well.

Other than that, I have no problems with the decision or rationale.  I agree, as I am sure that everyone else does, that MD4
should be retired.  

Some nits:

1.  "Section 6 also discussed" should be "Section 6 also discusses"   This occurs in several places.

2. " The RC4-HMAC is supported in Microsoft's Windows 2000 and 
           later for backwards compatibility with Windows 2000. "
later supported by what?  I assume later versions of Windows, but it is probably a good idea to make this clear.

3. When you say that with one exception the impact of retiring MD4 would be minimal, it would be a good idea to mention that exception upfront.
It is fairly clear after you read the whole impact section  that the exception is the Microsoft RFCs, but nowhere where is that  said explicitly.

4.  I'm not sure wether or not   the discussion of MD4's resistance against key recovery attack really belongs in the impacts section (in the discussion
of RC4-HMAC).  It might give the impression that RC4-HMAC is secure against key recovery, and, given the other attacks found against MD4, it is reasonable
to believe that this security is only temporary.  I would suggest putting this discussion in the security considerations section, and also, wherever it does end up, adding the appropriate
caveats.






Catherine Meadows
Naval Research Laboratory
Code 5543
4555 Overlook Ave., S.W.
Washington DC, 20375
phone: [phone]
fax: [phone]
email: [e-mail]