Re: [secdir] Secdir review of draft-ietf-ospf-auth-trailer-ospfv3-08

[Stephen Farrell <[e-mail]>]

+1 to what Sam said,
S

On 29 Oct 2011, at 20:42, Sam Hartman <[e-mail]> wrote:

> Hi.  The rationale behind the IANA registry is to avoid related protocol
> attacks.  The intent is to have a registry for protocols (there are a
> number in the routing area) that use similar layouts for authentication
> information to avoid related protocol attacks when the same key is used
> cross-protocol.el :So, anything sufficiently similar to this needs to be
> registered.  I think the registry is the result of a fairly tight
> compromise already and I would not recommend re-opening that discussion.
> I'd be delighted if you want to propose better names for the registry or
> the initial registration; I suspect we're not tied to those.
> 
> I do not support removing the key-strength indication.  Realistically I
> think this application probably does require at least 64-bits of
> security (assuming there are no hash collision issues, which would
> double the security requirement). I don't actively support reducing the
> key strength requirement below 128-bits, but I'm not opposed if someone
> really wants to do that. Note that a 16-character password does not meet
> the current requirement: passwords are typically not random drown from
> the set of all binary values of a given size.