Subject: Re: [Gen-art] Re: Gen-ART Review of draft-ietf-sip-target-dialog-03

From: Harald Tveit Alvestrand <[email-masked]>
Date: Tue, 03 Jan 2006 15:35:16 +0100

(unsolicited butt-in, as always)

--On onsdag, desember 28, 2005 00:57:48 -0600 Dean Willis 
<[email-masked]> wrote:

>
> Thanks, Spencer. I agree with your suggestion. I think that we could add
> the "sufficiently" word and maybe a note defining sufficiently, like "(16
> bits)" as instructions to the RFC editor, if no other feedback from the
> IETF LC causes the draft to be revised.

16 bits is 100% guessable in 2^16 tries = 65536.

It may be a tad small..... the complete sentence seems to be

   The second condition is that the dialog
   identifiers be cryptographically random that they cannot be guessed.
   RFC 3261 requires global uniquess for the Call-ID and 32 bits of
   cryptographic randomness for each tag (there are two tags for a
   dialog).  Given the short duration over which a typical dialog exists
   (perhaps as long as a day), this amount of randomness appears
   adequate to prevent guessing attacks.

So "adequate" seems to be already defined as 2x32 bits...

_______________________________________________
Gen-art mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/gen-art

---

From: Jonathan Rosenberg <[email-masked]>
Date: Tue, 03 Jan 2006 10:23:21 -0500

Right - the sentence that follows the one in question defines 
crypto-random. All that is needed, I think, is to insert the word 
"sufficiently", as the next sentences define it.

Would that be OK?

-Jonathan R.

-- 
Jonathan D. Rosenberg, Ph.D.                   600 Lanidex Plaza
Cisco Fellow                                   Parsippany, NJ 07054-2711
Cisco Systems
[email-masked]                              FAX:   (973) 952-5050
http://www.jdrosen.net                         PHONE: (973) 952-5000
http://www.cisco.com