Subject: Re: [kitten] [sasl] WGLC on draft-ietf-kitten-digest-to-historic-00

From: Alexey Melnikov <[email-masked]>
Date: Tue, 14 Sep 2010 19:31:24 +0100

Simon Josefsson wrote:

>I have re-read the document and this version looks good to me.  Two
>comments below.
>
>1)
>
>I believe the document should contain a pointer to SCRAM, RFC 5802.
>Then readers will understand that they are supposed to be implementing
>SCRAM instead of DIGEST-MD5.  I suggest adding at the end of section 1:
>
>  The SCRAM mechanism [RFC 5802] has been developed to provide similar
>  features as DIGEST-MD5 but with a better design.
>
>2)
>
>In section 1, I would add the following bullet under 8:
>
>  C.  The DES cipher for the security layer is considered insecure
>      due to its small key space.
>
I've just posted a new version with these 2 changes.

I haven't seen any other WGLC comments.

---

From: Sean Turner <[email-masked]>
Date: Tue, 14 Sep 2010 15:57:05 -0400

> I haven't seen any other WGLC comments.

Somebody might complain that CRAM, 3DES, and RC4 aren't spelled out on 
first occurrence.

Maybe we should add references for the claims in 8a (I agree with your 
assertions but others might want proof).

o MD5 see https://datatracker.ietf.org/doc/draft-turner-md5-seccon-update/

o RC4 see
https://datatracker.ietf.org/doc/draft-josefsson-rc4-test-vectors/

o DES is a block cipher with a 56 bit key.  Based on a 1996 report and 
date adjusting the value, the report recommends 102.6 bits as a good 
all-around choice for system security [RFC3766].

spt

---

From: Alexey Melnikov <[email-masked]>
Date: Mon, 20 Sep 2010 17:47:05 +0100

Hi Sean,

> Somebody might complain that CRAM, 3DES, and RC4 aren't spelled out on 

Will do.

> o MD5 see 
> https://datatracker.ietf.org/doc/draft-turner-md5-seccon-update/
>
> o RC4 see

Ok, added these as Informative references.

> all-around choice for system security [RFC3766].

I've added the reference, but I am not sure whether you suggest some text change or not.

---

From: Sean Turner <[email-masked]>
Date: Mon, 20 Sep 2010 14:05:46 -0400

> I've added the reference, but I am not sure whether you suggest some 

I was thinking that you could just add those three bullets.

spt

---

From: Peter Saint-Andre <[email-masked]>
Date: Mon, 20 Sep 2010 13:47:24 -0600

>   features as DIGEST-MD5 but with a better design.

+1 -- that speaks only about the motivation behind RFC 5802, which I
think is appropriate here.

Peter

-- 
Peter Saint-Andre
https://stpeter.im/