Subject: [Last-Call] Genart telechat review of draft-ietf-lamps-cms-update-alg-id-protect-03

From: Peter Yee via Datatracker <[email-masked]>
Date: Tue, 25 Aug 2020 21:30:59 -0700

Reviewer: Peter Yee
Review result: Ready with Nits

I am the assigned Gen-ART reviewer for this draft. The General Area
Review Team (Gen-ART) reviews all IETF documents being processed
by the IESG for the IETF Chair. Please wait for direction from your
document shepherd or AD before posting a new version of the draft.

For more information, please see the FAQ at

<https://trac.ietf.org/trac/gen/wiki/GenArtfaq>.

Document: draft-ietf-lamps-cms-update-alg-id-protect-03
Reviewer: Peter Yee
Review Date: 2020-08-25
IETF LC End Date: 2020-08-10
IESG Telechat date: 2020-08-27

Summary: This update to CMS (RFC 5262) attempts to prevent algorithm
substitution attacks on the hash algorithms. The changes seems reasonable, with
one of them already being specified in RFC 6211. There are a few nits that
should be cleared up prior to publication. [Ready with Nits]

Major issues: None

Minor issues: None

Nits/editorial comments:

Page 2, section 1, 2nd paragraph, last sentence: change "associate" to
"associated".

Page 4, 1st NEW block, 4th sentence: insert "the" before "signedAttrs field".

Page 5, section 3.5, 2nd paragraph, 1st sentence: insert "the" before "same
digest".

Page 5, section 4 title: change "Recommend" to "Recommended" for parallel
construction with the section 3 title.

Page 6, ADD block: delete the first "known".

Page 6, section 6, 3rd paragraph, 5th sentence: change "signalling" to
"signaling".

---

From: Russ Housley <[email-masked]>
Date: Wed, 26 Aug 2020 12:20:59 -0400

> Page 2, section 1, 2nd paragraph, last sentence: change "associate" to

Done.

> Page 4, 1st NEW block, 4th sentence: insert "the" before "signedAttrs field".

Fixed.

> Page 5, section 3.5, 2nd paragraph, 1st sentence: insert "the" before "same

Done.

> construction with the section 3 title.

Okay, done.

> Page 6, ADD block: delete the first "known".

Based on another comment, I have reworded this to say:

   While there are no known algorithm substitution attacks today,
   the inclusion of the algorithm identifiers used by the originator
   as a signed attribute or an authenticated attribute makes such an
   attack significantly more difficult.

> Page 6, section 6, 3rd paragraph, 5th sentence: change "signalling" to

Done.

Thanks for the careful review.

Russ