Subject: Re: Privacy extensions to Stateless Address Autoconf

From: Brian Haberman <[email-masked]>
Date: Thu, 7 Oct 2004 09:59:39 -0400

<WG Chair hat off>

I see two issues with making a change to the hash algorithm.

First, changing the algorithm will not affect interoperability.  The
generation of the IID is local to each node.

Second, we are attempting to move this document from PS to
DS, so making a gratuitous change to the hash algorithm is not
usually favored.  In addition, will we change it again when a newer
algorithm comes along?

Perhaps an alternative, if people feel a need to move away from
MD5, would be to not specify a single hash, but rather give a list
of possible hashes.  And an informative pointer to RFC 1750
would help with this direction.

Other thoughts?

Regards,
Brian

--------------------------------------------------------------------
IETF IPv6 working group mailing list
[email-masked]
Administrative Requests: https://www1.ietf.org/mailman/listinfo/ipv6
--------------------------------------------------------------------

---

From: Francis Dupont <[email-masked]>
Date: Thu, 07 Oct 2004 21:44:12 +0200

In your previous mail you wrote:

=> so the change should not be a problem if it is justified.

   usually favored.

=> the argument is that MD5 is/shall be not available by default.
I suggest to give it to security area directors for an advice.

   In addition, will we change it again when a newer algorithm comes along?

=> your proposal is a nice answer.

=> this seems a wOnderful idea!

Thanks

[email-masked]

PS: draft-ietf-ipsec-esp-ah-algorithms-02.txt changes MD5 based algo
requirement levels from MUST to MAY so the argument about MD5 seems
to be right.