IETF Logo Mail Archive

Re: [secdir] SecDir review of draft-ietf-mpls-ldp-hello-crypto-auth-05

Stephen Farrell <stephen.farrell@cs.tcd.ie> Tue, 20 May 2014 21:23 UTC

Return-Path: <stephen.farrell@cs.tcd.ie>
X-Original-To: secdir@ietfa.amsl.com
Delivered-To: secdir@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 268521A0400; Tue, 20 May 2014 14:23:07 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.551
X-Spam-Level:
X-Spam-Status: No, score=-2.551 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RP_MATCHES_RCVD=-0.651] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 9WWmlXD2MKI0; Tue, 20 May 2014 14:23:05 -0700 (PDT)
Received: from mercury.scss.tcd.ie (mercury.scss.tcd.ie [134.226.56.6]) by ietfa.amsl.com (Postfix) with ESMTP id B95931A03D3; Tue, 20 May 2014 14:23:05 -0700 (PDT)
Received: from localhost (localhost [127.0.0.1]) by mercury.scss.tcd.ie (Postfix) with ESMTP id 68ABBBE61; Tue, 20 May 2014 22:23:04 +0100 (IST)
X-Virus-Scanned: Debian amavisd-new at scss.tcd.ie
Received: from mercury.scss.tcd.ie ([127.0.0.1]) by localhost (mercury.scss.tcd.ie [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id WCS3d7Rj5dx6; Tue, 20 May 2014 22:23:03 +0100 (IST)
Received: from [10.87.48.12] (unknown [86.46.25.179]) by mercury.scss.tcd.ie (Postfix) with ESMTPSA id 3C189BE38; Tue, 20 May 2014 22:23:03 +0100 (IST)
Message-ID: <537BC7B6.5040406@cs.tcd.ie>
Date: Tue, 20 May 2014 22:23:02 +0100
From: Stephen Farrell <stephen.farrell@cs.tcd.ie>
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:24.0) Gecko/20100101 Thunderbird/24.5.0
MIME-Version: 1.0
To: "Bhatia, Manav (Manav)" <manav.bhatia@alcatel-lucent.com>, IETF Security Directorate <secdir@ietf.org>, The IESG <iesg@ietf.org>, "draft-ietf-mpls-ldp-hello-crypto-auth.all@tools.ietf.org" <draft-ietf-mpls-ldp-hello-crypto-auth.all@tools.ietf.org>
References: <53761B24.1060501@gmail.com> <20211F91F544D247976D84C5D778A4C32E60982F@SG70YWXCHMBA05.zap.alcatel-lucent.com> <537A694C.60101@gmail.com>
In-Reply-To: <537A694C.60101@gmail.com>
X-Enigmail-Version: 1.6
Content-Type: text/plain; charset="windows-1252"
Content-Transfer-Encoding: 8bit
Archived-At: http://mailarchive.ietf.org/arch/msg/secdir/YvyQaehxU8B6tnlb2MV1L8sggOk
Cc: "manavbhatia@gmail.com" <manavbhatia@gmail.com>
Subject: Re: [secdir] SecDir review of draft-ietf-mpls-ldp-hello-crypto-auth-05
X-BeenThere: secdir@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: Security Area Directorate <secdir.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/secdir>, <mailto:secdir-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/secdir/>
List-Post: <mailto:secdir@ietf.org>
List-Help: <mailto:secdir-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/secdir>, <mailto:secdir-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 20 May 2014 21:23:07 -0000


On 19/05/14 21:27, Yaron Sheffer wrote:
>>>
>>> • 5.1: Redefining HMAC (RFC 2104) is an extremely bad idea. This
>>> reviewer does not have the appropriate background to critique the
>>> proposed solution, but there must be an overwhelming reason to reopen
>>> cryptographic primitives.
>>
>> This is a decision that was taken by Sec Ads when we were doing the
>> crypto protection for the IGPs based on some feedback from NIST. This
>> mathematics is not new and has been done for all IGPs and has been
>> approved and rather encouraged by the Security ADs.

The above does not sound like something I recognise. I
have repeatedly asked that documents not re-define HMAC.
Perhaps this time, I'll make that a DISCUSS and not budge.
I probably should have done that before TBH.

If you are revising that doc, *please* get rid of the
re-definition and just properly refer to HMAC. Its about
time to stop repeating that error.

S.

v2.23.0 | Report a Bug | By Email