Re: [secdir] secdir review of draft-ietf-csi-send-name-type-registry-03

[Sean Turner <[e-mail]>]

Roque,

I think what Pat is suggesting that at some point in the future SHA-1 
might not be required and then we'd need to do another update to the 
registry.  We could do a little future proofing by including registry 
entries for SHA-224, SHA-256, SHA-384, and SHA-512 in this I-D.

spt

Roque Gagliano wrote:
> Patrick,
> 
> Thank you for your review.
> 
> You are correct oonly 160 bits SHA-1 hash is defined in RFC 5280 and 
> required in draft-ietf-sidr-res-cert
> 
> Regards,
> 
> Roque
> 
> On Sat, May 8, 2010 at 4:58 PM, Patrick Cain <[e-mail] 
> <mailto:[e-mail]>> wrote:
> 
>     Hi,
> 
>     I have reviewed this document as part of the security directorate's
>     ongoing
>     effort to review all IETF documents being processed by the IESG.  These
>     comments were written primarily for the benefit of the security area
>     directors.  Document editors and WG chairs should treat these
>     comments just
>     like any other last call comments.
> 
>     About this document:
> 
>     SEcure Neighbor Discovery (SEND) defines the Name Type field in the
>       Trust Anchor option.  This document request to IANA the creation and
>       management of a registry for this field.  This document also
>       specifies a new Name Type field based on a certificate Subject Key
>       Identifier (SKI).
> 
>     My comments:
> 
>     The document has no major technical shortcomings that I could find.
> 
>     I do note that the new registry value defined in this document relies on
>     SHA-1 (160).
>     This may be a good time to save a few RFC numbers and define a value
>     for the
>     impending other SHA values, like SHA-2, although I'm not so sure
>     they exist
>     in x.509
>     certificates yet.
> 
>     Pat
> 
> 
> 
>