Re: [secdir] Secdir review of draft-ietf-ospf-auth-trailer-ospfv3-08

[Sam Hartman <[e-mail]>]

Hi.  The rationale behind the IANA registry is to avoid related protocol
attacks.  The intent is to have a registry for protocols (there are a
number in the routing area) that use similar layouts for authentication
information to avoid related protocol attacks when the same key is used
cross-protocol.el :So, anything sufficiently similar to this needs to be
registered.  I think the registry is the result of a fairly tight
compromise already and I would not recommend re-opening that discussion.
I'd be delighted if you want to propose better names for the registry or
the initial registration; I suspect we're not tied to those.

I do not support removing the key-strength indication.  Realistically I
think this application probably does require at least 64-bits of
security (assuming there are no hash collision issues, which would
double the security requirement). I don't actively support reducing the
key strength requirement below 128-bits, but I'm not opposed if someone
really wants to do that. Note that a 16-character password does not meet
the current requirement: passwords are typically not random drown from
the set of all binary values of a given size.