Re: [secdir] Secdir review of draft-ietf-sidr-rpki-algs-04

[Stephen Kent <[e-mail]>]

At 1:37 PM -0700 3/27/11, Brian Weis wrote:
>I have reviewed this document as part of the security directorate's 
>ongoing effort to review all IETF documents being processed by the 
>IESG. These comments were written primarily for the benefit of the 
>security area directors. Document editors and WG chairs should treat 
>these comments just like any other last call comments.
>
>This document describes the algorithm suite used as part of the 
>RPKI. The suite specifies a single signature algorithm (RSA) with a 
>single key size, a single hashing algorithm (SHA-256), a single 
>signature format, and formats for describing the public key. Section 
>5 indicates that this profile will be updated when the RPKI needs to 
>adapt different choices. I was glad to see such an algorithm agility 
>plan, but this implies that this will in fact never have a peer 
>document describing another profile. In such a case I would expect 
>the document title to be more inclusive (e.g., drop the first three 
>words of the title). Alternatively, it might be helpful to describe 
>in Section 5 under what circumstance another profile would be 
>published instead of updating this one.
>
>The Security Considerations document refers the reader to the 
>security considerations described in several other documents. After 
>reading those sections, I agree this is appropriate.
>
>Brian

Brian,

There will be another profile that will define two sets of algs, 
current and next.  See daft-sidr-algorithm-agility-00.txt for the 
description of how alg migration is anticipated to work. I hesitate 
to put a (normative) reference to that doc in here, because it is not 
yet approved and might slow down the
set of SIDR docs that rely, normatively, on the doc that you reviewed.

Steve