[Secdispatch] Clarification Question for the Comment from Eric Rescorla (

["Dr. Pala" <[e-mail]>]

Hi Eric, all,

I am sorry I had quite a hard time to understand the questions/comments 
today, however, I would like to properly address the raised concerns/points.

*Clients / Software Updates Comment:*

    I wanted to understand your questions/comments about the need to
    update clients and that would never happen.

    Could you please elaborate on this point ?

    It is my understanding that we do have to update our crypto
    libraries when we want to support a new algorithm, and that is what
    we are talking about. Any time we add a new algorithm, the software
    needs to be updated - but I do not see why this is a problem
    specific for this solution. ALL of the approaches will need software
    updates (exactly as we did for TLS 1.3).

    Personally, I think that Composite Crypto is also interesting from
    this point of view since updating the crypto layer will enable its
    use without the need to change protocols or application behavior.
     From an application-development point of view, IMHO, it is a very
    intriguing approach.

*SHA-1 Transition:*

    One of your comments, if I am not mistaken, was about comparing one
    of the possible solutions to the problem (Composite Crypto) with the
    SHA-1 transitioning period - how, in your opinion, is that
    transition process related to the specifics of the proposal ?

Again, I am sorry I could not understand the questions clearly (normal 
language barrier issues :D), but I hope I can address your concerns on 
the list.

Thanks again,

Cheers,
Max


-- 
Best Regards,
Massimiliano Pala, Ph.D.
OpenCA Labs Director
OpenCA Logo