Re: [tcpm] SHA-2 auth draft on TCP-AO

[Gregory Lebovitz <[e-mail]>]

Folks,
I haven't been monitoring the -AO work for a few years now, but happened to
be scanning and see this thread today. Pls excuse the late entry. Comments
inline...

On Wed, Jun 18, 2014 at 10:30 AM, Joe Touch <[e-mail]> wrote:

>
>
> On 6/18/2014 9:12 AM, Brian Weis wrote:
>
>> Hi Joe,
>>
>> On Jun 18, 2014, at 5:04 AM, Sujeet Nayak A (sua) <[e-mail]> wrote:
>>
>>  Hi Joe,
>>> Thanks a lot of your quick and valuable comments:
>>>
>>>  This doc should, AFAICT, update RFC 5926
>>>>>
>>>>
>> We're proposing updates to the IANA registries to add new
>> algorithms,but it is not our goal to change the requirements language in
>> RFC 5926.
>>
>
> RFC 5926 indicates the security algs for TCP-AO; this doc proposes to
> augment that list. Yes, that's captured by the IANA registry, but the way
> RFC 5926 is written appears to indicate that additions to that registry
> should UPDATE that RFC. If the WG or IESG sees otherwise, that's fine with
> me.


As its primary author/editor, and with the agreement of the TCPM WG and
Security Directorate at the time, the goal of creating 5926 was that it
would be the "short and sweet pluggable module" for crypto algos for 5925.
This allowed any implementor of 5925 to have one and only one doc to read
re: specified crypto algos AT ANY GIVEN POINT IN HISTORY. The idea was that
when it was time to add another algo, like SHA2 (it was the one in mind at
that time, in fact), or to deprecate an algo, all one would need to do is a
(relatively painless) revision to 5926. I recommend we keep it that way,
rather than take any short cuts that would result in spinning out
additional RFC riders to 5925.

All that needs to be done for a 5926bis is:
1) Add the new Auth Algo & Corresponding KDF to the tables in sect 2.2
2) Insert new KDF into the bullet list in sect 3.1.1 intro
3) insert new sect 3.1.1.x with the new KDF implementation details
4) insert new Auth Algo into bullet list in intro of sect 3.2
5) insert new sect 3.2.x with new Auth Algo implementation details
6) add any new Auth Algo / KDF security considerations to SCs section, if
applicable
7) add new line to IANA table in sect 5

Pretty simple, really.

If you'll provide the details above in an email to the list, I'd be happy
to place them into the document and send out an update, adding the
contributor (Rohit?) as an author.

Let me know,

Gregory


>
>
>  There isn't any compelling reason to change the existing algorithm
>> requirements as both algorithms remain acceptable. We should clarify
>> that the algorithm recommendations are really only relevant when this
>> Internet-Draft is implemented. An implementation of TCP-AO still is
>> required to comply with RFC 5926, but if it also implements this draft
>> then it would need to pay attention to the algorithm recommendations in
>> this draft.
>>
>
> That's how all RFCs work, though. It would certainly be useful to be more
> clear about the impact of this doc - i.e., that it adds additional optional
> algorithms, rather than deprecating existing ones.
>
> Joe
>
>
> _______________________________________________
> tcpm mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/tcpm
>



-- 
----
IETF related email from
Gregory M. Lebovitz