Subject: [Gen-art] Gen-ART review of draft-eastlake-additional-xmlsec-uris-09.txt

From: Suresh Krishnan <[email-masked]>
Date: Sat, 23 Feb 2013 23:58:12 -0500

I have been selected as the General Area Review Team (Gen-ART) reviewer
for this draft (for background on Gen-ART, please see
http://www.alvestrand.no/ietf/gen/art/gen-art-FAQ.html).

Please wait for direction from your document shepherd or AD before
posting a new version of the draft.

Document: draft-eastlake-additional-xmlsec-uris-09.txt
Reviewer: Suresh Krishnan
Review Date: 2013/02/23
IESG Telechat date: 2013/02/28
IETF Last call end date: 2013/02/28

Summary: This document is almost ready for publication as a Proposed
Standard but I have some comments you may wish to address.

Minor
=====

* Section 2.1.1.

The following text is a bit misleading as it looks like this document is
taking a stance on the use of MD5.

"Use of MD5 is NOT RECOMMENDED [RFC6151]."

Suggest rewording to something like

"Please note that the use of MD5 is no longer recommended for digital
signatures [RFC6151]."

* Section 2.3.1.

Same comment as for Section 2.1.1.

* Security Considerations

Again, this paragraph looks like it is making recommendations that
duplicate the recommendations from RFC6151. Is this paragraph really
necessary?

"Due to computer speed and cryptographic advances, the use of MD5 as a
DigestMethod or in the RSA-MD5 SignatureMethod is NOT RECOMMENDED.
The cryptographic advances concerned do not affect the security of
HMAC-MD5; however, there is little reason not to go for one of the
SHA series of algorithms."

Downrefs
========

There are 9 downrefs that have not been called out. 5 of them are listed
in the downref registry. The other 4 downrefs are listed below

RFC2315
RFC4050
RFC4269
RFC6234

Thanks
Suresh

---

From: Donald Eastlake <[email-masked]>
Date: Sun, 24 Feb 2013 21:04:36 -0500

Hi Suresh,

Thanks for the review.

> "Please note that the use of MD5 is no longer recommended for digital

OK.

> Same comment as for Section 2.1.1.

OK.

> SHA series of algorithms."

The inclusion of something about the inadvisability of MD5 was
suggested to me by an AD. I'm perfectly happy to re-word things so
that it does not "take a stance" but merely provides informative
pointers as a convenience to the reader.

> in the downref registry. The other 4 downrefs are listed below

Thanks,
Donald
=============================
 Donald E. Eastlake 3rd   +1-508-333-2270 (cell)
 155 Beaver Street, Milford, MA 01757 USA
 [email-masked]