Re: [vwrap] authentication : remove reference to MD5

>> okay.
>>
>> if we're going to remove VWRAP from all current implementations,
>
> What does that mean? I thought we were trying to build VWRAP into
> implementations, not rip it out. :)

Right, I think the right approach is to think about adding a "VWRAP  
compatibility layer" to existing implementations, and keeping that  
layer as simple as possible (but no simpler!).

That raises the question of where changing hashes falls w.r.t.  
simplicity.  It might seem like you would want to keep MD5 so that the  
compatibility layer wouldn't have to re-hash things.  However, it  
already seems like there's going to be a need for the compatibility  
layer to translate names, which will (presumably) break signatures  
already.  So since there's already need to re-hash, it's not a big  
deal to re-hash with a different hash function.

--Richard

>> i
>> vote we remove MD5 from the auth spec and replace it with a MIC with
>> better security properties, like SHA224 or SHA256.
>
> +1 to more secure authentication.
>
> My quick reading of the authentication draft led me to think that it
> needed a thorough review, but unfortunately I haven't had time to do
> that yet.
>
> Peter
>
> -- 
> Peter Saint-Andre
> https://stpeter.im/
>
>
>
> _______________________________________________
> vwrap mailing list
> vwrap@ietf.org
> https://www.ietf.org/mailman/listinfo/vwrap