Re: [secdir] secdir review of draft-ietf-csi-send-name-type-registry-03

Sean Turner <turners@ieca.com> Tue, 11 May 2010 16:10 UTC

Return-Path: <turners@ieca.com>
X-Original-To: secdir@core3.amsl.com
Delivered-To: secdir@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 86DFB3A6D25 for <secdir@core3.amsl.com>; Tue, 11 May 2010 09:10:06 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -0.682
X-Spam-Level:
X-Spam-Status: No, score=-0.682 tagged_above=-999 required=5 tests=[AWL=-0.684, BAYES_50=0.001, UNPARSEABLE_RELAY=0.001]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id KpjBbfokabYR for <secdir@core3.amsl.com>; Tue, 11 May 2010 09:10:06 -0700 (PDT)
Received: from smtp114.biz.mail.re2.yahoo.com (smtp114.biz.mail.re2.yahoo.com [66.196.116.99]) by core3.amsl.com (Postfix) with SMTP id F04FA3A6D23 for <secdir@ietf.org>; Tue, 11 May 2010 09:10:02 -0700 (PDT)
Received: (qmail 51875 invoked from network); 11 May 2010 16:09:49 -0000
Received: from thunderfish.local (turners@71.191.14.208 with plain) by smtp114.biz.mail.re2.yahoo.com with SMTP; 11 May 2010 09:09:49 -0700 PDT
X-Yahoo-SMTP: ZrP3VLSswBDL75pF8ymZHDSu9B.vcMfDPgLJ
X-YMail-OSG: sudkxtgVM1nvhnLoma10A1Jwn_0dN0VcaiauQ_WnOnHhI0AkPCH1uYgOWjqpnJN8tLiSivDcuJF_CSrYfeHzXnwTU2rnm3XUKIXBgfCvrMXOLNDDOskMqPrMapSaef2Gp5X5UvETgrVoaHKHlXhMv.Q3PclPfK06r4uecni8EnRpy_nXuBlon.nF2sz1AApuemigsP1gj4GbXxB.YOEyvWMA9cDjt2Jm0ygRoSslEVVqo1tW2_lWBbQCBYGAg_Ux9ivN1OqdHYcR4atbgN7l3o4cOsnMJPhzwGQtCQetJWpxCQiadhyN1s0AHGsPgc2plHr399JL9ro5CQrNmwkrMxa3mBAAkf.ujja.i2.kxjZiJgn6epWJjL1pWEsb9PkllV._ywuZdygw.8BFOo..0Zrx1JOnTo__aFbNf6NGrlV.QtuxVK4QjX1TXg70bzx9Uu423Xsxg0U5saAtj7uqG1YwklNyAmtSG1nOD1qNbQ--
X-Yahoo-Newman-Property: ymail-3
Message-ID: <4BE9814D.6040404@ieca.com>
Date: Tue, 11 May 2010 12:09:49 -0400
From: Sean Turner <turners@ieca.com>
User-Agent: Thunderbird 2.0.0.24 (Macintosh/20100228)
MIME-Version: 1.0
To: Roque Gagliano <roque.lacnic@gmail.com>
References: <020001caeebe$ffdcd560$ff968020$@com> <AANLkTikBkBWm8hY9Jyj7PxciFc8FRrnbII_OajwD7Gt2@mail.gmail.com>
In-Reply-To: <AANLkTikBkBWm8hY9Jyj7PxciFc8FRrnbII_OajwD7Gt2@mail.gmail.com>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
Cc: secdir@ietf.org, iesg@ietf.org, draft-ietf-csi-send-name-type-registry.all@tools.ietf.org
Subject: Re: [secdir] secdir review of draft-ietf-csi-send-name-type-registry-03
X-BeenThere: secdir@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Security Area Directorate <secdir.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/secdir>, <mailto:secdir-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/secdir>
List-Post: <mailto:secdir@ietf.org>
List-Help: <mailto:secdir-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/secdir>, <mailto:secdir-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 11 May 2010 16:10:06 -0000

Roque,

I think what Pat is suggesting that at some point in the future SHA-1 
might not be required and then we'd need to do another update to the 
registry.  We could do a little future proofing by including registry 
entries for SHA-224, SHA-256, SHA-384, and SHA-512 in this I-D.

spt

Roque Gagliano wrote:
> Patrick,
> 
> Thank you for your review.
> 
> You are correct oonly 160 bits SHA-1 hash is defined in RFC 5280 and 
> required in draft-ietf-sidr-res-cert
> 
> Regards,
> 
> Roque
> 
> On Sat, May 8, 2010 at 4:58 PM, Patrick Cain <pcain@coopercain.com 
> <mailto:pcain@coopercain.com>> wrote:
> 
>     Hi,
> 
>     I have reviewed this document as part of the security directorate's
>     ongoing
>     effort to review all IETF documents being processed by the IESG.  These
>     comments were written primarily for the benefit of the security area
>     directors.  Document editors and WG chairs should treat these
>     comments just
>     like any other last call comments.
> 
>     About this document:
> 
>     SEcure Neighbor Discovery (SEND) defines the Name Type field in the
>       Trust Anchor option.  This document request to IANA the creation and
>       management of a registry for this field.  This document also
>       specifies a new Name Type field based on a certificate Subject Key
>       Identifier (SKI).
> 
>     My comments:
> 
>     The document has no major technical shortcomings that I could find.
> 
>     I do note that the new registry value defined in this document relies on
>     SHA-1 (160).
>     This may be a good time to save a few RFC numbers and define a value
>     for the
>     impending other SHA values, like SHA-2, although I'm not so sure
>     they exist
>     in x.509
>     certificates yet.
> 
>     Pat
> 
> 
> 
>