Subject: [Gen-art] review of draft-turner-md5-seccon-update-07.txt

From: Francis Dupont <[email-masked]>
Date: Fri, 10 Dec 2010 10:45:37 +0100

I am the assigned Gen-ART reviewer for this draft. For background on
Gen-ART, please see the FAQ at <
http://wiki.tools.ietf.org/area/gen/trac/wiki/GenArtfaq>.

Please resolve these comments along with any other Last Call comments you
may receive.

Document: draft-turner-md5-seccon-update-07.txt
Reviewer: Francis Dupont
Review Date: 2010-12-06
IETF LC End Date: 2010-12-22
IESG Telechat date: unknown

Summary: Not Ready

Major issues:
 - IANA action is to change a field which doesn't exist

 - there is no consensus if the document should stress not-security uses
  of MD5 are perfectly fine or at the opposite the security label attached
  to MD5 raises practical issues so new uses of MD5 should be strongly
  discouraged or both are out of scope...

Minor issues: None

Nits/editorial comments:
 - 2.1 page 2: Psuedo -> Pseudo

 - 2.1 page 3: 1.6 GHz. -> 1.6GHz (note: suggestion for removing the space,
  fix for the spurious '.' after an unit)

 - 2.3 page 3: (suggestion) H(IV,M). -> H(IV, M).

Regards

[email-masked]

PS: about 3:

   IANA is requested to update the md5 usage entry in the Hash Function 
   Textual Names registry by replacing "COMMON" with "DEPRECATED". 

I understand why the md5 is in lower case (it is the name of the entry)
but I can't find the usage field in the registry at:

http://www.iana.org/assignments/hash-function-text-names/
hash-function-text-names.xhtml

PPS: my proposal for solving the two issues is:
 - give the first one to IANA (IANA has to address it anyway)
  (PS: in fact IANA already raised a question about this point!)
 - use the standard Last Call process for the second

---

From: Sean Turner <[email-masked]>
Date: Fri, 10 Dec 2010 09:20:34 -0500

Francis,

Thanks for your review.  Responses inline.

spt

On 12/10/10 4:45 AM, Francis Dupont wrote:
> Gen-ART, please see the FAQ at<

Paul Hoffman suggested that the IANA considerations be changed to 
"None."  The hash algorithm textual name registry really ought to be 
updated by the folks who registered it not in this outlier document and 
without some context the values like "deprecated" (see next issue) 
really doesn't make any sense to stick in a registry.

FYI - the registry was updated in draft-turner-md2-to-historic - and 
there was NO way for you to know that (sorry about the confusion).  I'm 
going to make that IANA consideration "None" too.

>    discouraged or both are out of scope...

Yeah not sure how I'm going to "solve" this one.  I'll propose some text 
and see what happens.

>   - 2.3 page 3: (suggestion) H(IV,M). ->  H(IV, M).

Will fix up.

> but I can't find the usage field in the registry at:

As noted about, the registry was updated in another draft 
draft-turner-md2-to-historic.  Making them "None" ought to solve this 
problem.