Re: [secdir] Secdir review of draft-ietf-sidr-rpki-algs-04

[Brian Weis <[e-mail]>]

On Mar 28, 2011, at 9:19 AM, Stephen Kent wrote:

> At 1:38 AM -0700 3/28/11, Brian Weis wrote:
>> ....
>> >
>> > There will be another profile that will define two sets of algs, current and next.  See daft-sidr-algorithm-agility-00.txt for the description of how alg migration is anticipated to work.
>> 
>> I had looked through the algorithm-agility document before commenting but didn't see that it declared that a new profile would be generated. Your description of ("two sets of algs, current and next") seems to match the intent of Section 5, such that it would be an update to this same profile. Here's the text in question:
>> 
>>   "It is anticipated that the RPKI will require the adoption of updated
>>    key sizes and a different set of signature and hash algorithms over
>>    time, in order to maintain an acceptable level of cryptographic
>>    security to protect the integrity of signed products in the RPKI.
>>    This profile should be updated to specify such future requirements,
>>    as and when appropriate."
>> 
>> When I read 'updated' I assume it means it adds to the same profile, and the subsequent 'update' will be published under the same name as the original. Is that your intent?
> 
> yes, although "update" is the wrong RFC term. It should say "replace."  we shoud make that change, to the text.
> 
>> > I hesitate to put a (normative) reference to that doc in here, because it is not yet approved and might slow down the
>> > set of SIDR docs that rely, normatively, on the doc that you reviewed.
>> Understood, and I didn't mean to imply a normative reference was needed -- just an informational explanation of why a different profile might be needed rather than an update to this one. But if that isn't actually expected, then I was questioning why the title implied there would in fact be independent profiles.
> 
> OK.  And I agree that we probably should change the name to be "The Profile for Algorithms and Key Sizes ..." since we anticipate a replacement for this doc when we adopt new algs.

Sounds great. I had no other concerns.

Thanks,
Brian

> 
> Steve


-- 
Brian Weis
Security Standards and Technology, SRTG, Cisco Systems
Telephone: [phone]
Email: [e-mail]