Re: [secdir] Secdir last call review of draft-ietf-lisp-sec-26

[Luigi Iannone <[e-mail]>]

Hi again Alexey,

> On 8 Jun 2022, at 18:58, Alexey Melnikov <[e-mail]> wrote:
>> 
>> Wouldn’t this create an issue with older implementations?
>> Do you think that text could be adapted to RECOMMEND SHA-256 also expressing the concern that old implementation may not interoperate?
>>> As a side note, this is what I found in draft-ietf-lisp-rfc6833bis:
>>> 
>>>    2.  Implementations SHOULD use the 'HMAC-SHA256-128+HKDF-SHA256' as
>>>        the Algorithm ID (Section 12.5) in Map-Register message
>>>        (Section 5.6), and MUST NOT use 'None' or 'HMAC-SHA-1-96-None' as
>>>        Algorithm ID (Section 12.5) in the Map-Register message
>>>        (Section 5.6)
>>> 
>>> 
>>>       1:  The KDF algorithm is identified by the field 'Algorithm ID'
>>>           according to the table in Section 12.5.  Implementations of
>>>           this specification MUST implement HMAC-SHA-256-128 [RFC4868]
>>>           and SHOULD implement HMAC-SHA-256-128+HKDF-SHA256 [RFC5869] .
>>> 
>>> 
>>>    To publish an authoritative EID-to-RLOC mapping with a Map-Server
>>>    using the Map-Register message, an ETR includes authentication data
>>>    that is a MAC of the entire message using a key derived from the pre-
>>>    shared secret.  An implementation SHOULD support HMAC-SHA256-
>>>    128+HKDF-SHA256 [RFC5869].
>>> 
>>> There are some possible inconsistencies between this draft and draft-ietf-lisp-rfc6833bis.
>>> 
>> 
>> Can you be more specific?
> So in draft-ietf-lisp-sec-26 the requirements are:
> 
> MUST AUTH-HMAC-SHA-1-96
> MUST AES-KEY-WRAP-128+HKDF-SHA256
> MUST HKDF-SHA1-128
> 
> In draft-ietf-lisp-rfc6833bis (in the 3 paragraphs quoted above):
> 
> SHOULD HMAC-SHA256-128+HKDF-SHA256 and MUST NOT HMAC-SHA-1-96-None.
> MUST HMAC-SHA-256-128 and SHOULD HMAC-SHA-256-128+HKDF-SHA256
> 
> In the thirs paragraph: SHOULD HMAC-SHA256-128+HKDF-SHA256. This is similar to HMAC-SHA-256-128+HKDF-SHA256, but there is no "-" after HMAC-SHA". Is this a typo and should be the same as HMAC-SHA-256-128+HKDF-SHA256?
> 
> I appreciate that these recommendations are for different pieces of software, but, for example, you require use of HMAC-SHA-1-96 in one context and disallow its use in another. I am not saying that any of the above should change, but use of different hashing primitives doesn't seem very consistence above.

I understand your point and I agree. 
Not sure whether at this point is worth changing all of that.

Ciao

L.
 



> 
> Best Regards,
> Alexey
>