Subject: Re: [MMUSIC] draft-4572-update: Spec contains references to a number of obsoleted RFCs

From: Martin Thomson <[email-masked]>
Date: Sun, 1 Jan 2017 21:49:15 +1100

We can remove MD2.  MD5 is dead, SHA-1 is in its death throes, but MD2
is merely a (bad) memory.

On 30 December 2016 at 22:27, Christer Holmberg
<[email-masked]> wrote:
> Hi,
>
>
>
> Please note the following:
>
>
>
> RFC 6149, which obsoletes RFC 1319, makes MD2 historic. Do people have a
> problem with that? I assume we’ll end up in trouble with the security folks
> if we keep the old RFC…
>
>
>
> And, considering MD2 is historic, do we even need to mention it in
> draft-4572-update anymore?
>
>
>
> Regards,
>
>
>
> Christer
>
>
>
>
>
> From: mmusic [mailto:[email-masked]] On Behalf Of Christer Holmberg
> Sent: 30 December 2016 11:42
> To: [email-masked]
> Cc: Jonathan Lennox ([email-masked]) <[email-masked]>; Cullen
> Jennings ([email-masked]) <[email-masked]>
> Subject: [MMUSIC] draft-4572-update: Spec contains references to a number of
> obsoleted RFCs
>
>
>
> Hi,
>
>
>
> The idnits check returns the following for draft-4572-update.
>
>
>
> ** Obsolete normative reference: RFC 1319 (ref. '3') (Obsoleted by RFC 6149)
>
>
>
>   ** Downref: Normative reference to an Informational RFC: RFC 1321 (ref.
> '4')
>
>
>
>   ** Obsolete normative reference: RFC 3280 (ref. '8') (Obsoleted by RFC
> 5280)
>
>
>
>   ** Obsolete normative reference: RFC 4234 (ref. '11') (Obsoleted by RFC
>
>      5234)
>
>
>
>   ** Obsolete normative reference: RFC 4288 (ref. '12') (Obsoleted by RFC
>
>      6838)
>
>
>
>   ** Obsolete normative reference: RFC 4346 (ref. '13') (Obsoleted by RFC
>
>      5246)
>
>
>
>   -- Obsolete informational reference (is this intentional?): RFC 2617 (ref.
>
>      '15') (Obsoleted by RFC 7235, RFC 7615, RFC 7616, RFC 7617)
>
>
>
>   -- Obsolete informational reference (is this intentional?): RFC 3525 (ref.
>
>      '20') (Obsoleted by RFC 5125)
>
>
>
>   -- Obsolete informational reference (is this intentional?): RFC 3851 (ref.
>
>      '22') (Obsoleted by RFC 5751)
>
>
>
> The reason for this is that we used RFC 4572 as base, and did not
> change/update the references.
>
>
>
> I had a look, and I don’t think there should be any issues in replacing the
> current RFCs with the new ones. But, please indicate if you see any issues.
>
>
>
> Regards,
>
>
>
> Christer

---

From: Christer Holmberg <[email-masked]>
Date: Mon, 2 Jan 2017 10:41:26 +0000

Hi,

>We can remove MD2.  MD5 is dead, SHA-1 is in its death throes, but MD2 is merely a >(bad) memory.

So, my suggestion is to remove all references to MD2 (including the ABNF) for now, and we'll then see what the security folks say about MD5 and SHA-1.

Regards,

Christer

On 30 December 2016 at 22:27, Christer Holmberg <[email-masked]> wrote:
> RFC 6149, which obsoletes RFC 1319, makes MD2 historic. Do people have 
> a problem with that? I assume we’ll end up in trouble with the 
> security folks if we keep the old RFC…
>
>
>
> Subject: [MMUSIC] draft-4572-update: Spec contains references to a 
> number of obsoleted RFCs
>
>
>
> Hi,
>
>
>
> I had a look, and I don’t think there should be any issues in 
> replacing the current RFCs with the new ones. But, please indicate if you see any issues.
>
>
>
> Regards,
>
>
>
> Christer

---

From: Eric Rescorla <[email-masked]>
Date: Mon, 2 Jan 2017 10:03:37 -0800

On Mon, Jan 2, 2017 at 2:41 AM, Christer Holmberg <
[email-masked]> wrote:

> So, my suggestion is to remove all references to MD2 (including the ABNF)
> for now, and we'll then see what the security folks say about MD5 and SHA-1.
>

Given the threat model here, I think we want to tell people to ignore MD*
(i.e., treat it as an unknown hash) and to accept SHA-1 (though perhaps
only temporarily). Accordingly, I propose removing MD2 and MD5 from this
grammar, but leave SHA-1.

-Ekr

Regards,
> _______________________________________________
> mmusic mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/mmusic
>

---

From: Martin Thomson <[email-masked]>
Date: Tue, 3 Jan 2017 13:28:15 +1100

On 3 January 2017 at 05:03, Eric Rescorla <[email-masked]> wrote:
> (i.e., treat it as an unknown hash) and to accept SHA-1 (though perhaps only
> temporarily). Accordingly, I propose removing MD2 and MD5 from this grammar,
> but leave SHA-1.

That makes sense.  These busted hashes will then appear to be
unsupported extensions.

---

From: Christer Holmberg <[email-masked]>
Date: Tue, 3 Jan 2017 08:04:01 +0000

Hi,

I am fine to also remove MD5. However, I want to make sure we don't bring back Cullen's backward compatibility issues.

Regards,

Christer

Sent from my iPhone

> On 3 Jan 2017, at 4.28, Martin Thomson <[email-masked]> wrote:
>

---

From: Cullen Jennings <[email-masked]>
Date: Tue, 3 Jan 2017 10:34:35 -0700

Trivial nit but ...

Actually I don't think you want MD5 treated as a unknown hash, you want treated as a known but don't use. If A offers old and bad crypto to B, we have B log that such that we can track down and upgrade A. If we got a a new unknown cipher call SSHHAA we would not log that as bad crypto because we would assume it was new and good. 

> On Jan 2, 2017, at 11:03 AM, Eric Rescorla <[email-masked]> wrote:
> 
> On Mon, Jan 2, 2017 at 2:41 AM, Christer Holmberg <[email-masked]> wrote:
> Hi,
> 
> Given the threat model here, I think we want to tell people to ignore MD* (i.e., treat it as an unknown hash) and to accept SHA-1 (though perhaps only temporarily). Accordingly, I propose removing MD2 and MD5 from this grammar, but leave SHA-1.
> 
> -Ekr
> 
> 
> Regards,
> 
> Christer
> 
>

---

From: Cullen Jennings <[email-masked]>
Date: Tue, 3 Jan 2017 10:37:08 -0700

> On Jan 3, 2017, at 1:04 AM, Christer Holmberg <[email-masked]> wrote:
> 
> Hi,
> 

Everything I know that offered MD5 also offered SHA1 so I don't see any problem with not support MD5. And if there is a problem, I'm not very sympathetic.

---

From: Roman Shpount <[email-masked]>
Date: Tue, 3 Jan 2017 12:44:32 -0500

I agree, I think MD2 and MD5 should be defined in the grammar but
specification should state that they MUST NOT be used. This way there are
no potential backwards interop problems.

Regards,

_____________
Roman Shpount

On Tue, Jan 3, 2017 at 12:34 PM, Cullen Jennings <[email-masked]> wrote:

>
> Trivial nit but ...
>
> Actually I don't think you want MD5 treated as a unknown hash, you want
> treated as a known but don't use. If A offers old and bad crypto to B, we
> have B log that such that we can track down and upgrade A. If we got a a
> new unknown cipher call SSHHAA we would not log that as bad crypto because
> we would assume it was new and good.
>
>
> is merely a >(bad) memory.
> >
> > So, my suggestion is to remove all references to MD2 (including the
> ABNF) for now, and we'll then see what the security folks say about MD5 and
> SHA-1.
> >
> > Given the threat model here, I think we want to tell people to ignore
> MD* (i.e., treat it as an unknown hash) and to accept SHA-1 (though perhaps

---

From: Martin Thomson <[email-masked]>
Date: Wed, 4 Jan 2017 09:06:32 +1100

On 4 January 2017 at 04:44, Roman Shpount <[email-masked]> wrote:
> specification should state that they MUST NOT be used. This way there are no
> potential backwards interop problems.

To address Christer's original concern, I would say that you don't
need a reference to the algorithms to achieve that.  An informative
reference is as far as you might go.

---

From: Christer Holmberg <[email-masked]>
Date: Wed, 4 Jan 2017 11:22:05 +0000

Ok, to make sure we are all on the same page, below are the places in the previous version (-08) of the draft where MD2 and MD5 are mentioned, and my suggestion on what/if to do:

Section 5:
-------------

"hash-func              =  "sha-1" / "sha-224" / "sha-256" /
                             "sha-384" / "sha-512" /
                             "md5" / "md2" / token
                             ; Additional hash functions can only come
                             ; from updates to RFC 3279"

Christer's suggestion: Keep the text as it is.

-------------

   "Following RFC 3279 [7] as updated by RFC 4055 [9], therefore, the
   defined hash functions are 'SHA-1' [1] [18], 'SHA-224' [1], 'SHA-256'
   [1], 'SHA-384'[1], 'SHA-512' [1], 'MD5' [4], and 'MD2' [3], with
   'SHA-256' preferred.  A new IANA registry of Hash Function Textual
   Names, specified in Section 8, allows for addition of future tokens,
   but they may only be added if they are included in RFCs that update
   or obsolete RFC 3279 [7]."

Christer's suggestion: Keep the text, but update the MD2 and MD5 references ([3] and [4]), and add the following new paragraph text:

"For backward compatibility with implementations compliant with RFC 4572, the MD2 and MD5 cipher suite are still listed in the syntax. However, implementations compliant to this specification MUST NOT use them."

Section 8:
-------------

"Table 1 contains the initial values of this registry.

        +--------------------+------------------------+-----------+
        | Hash Function Name |          OID           | Reference |
        +--------------------+------------------------+-----------+
        |       "md2"        |   1.2.840.113549.2.2   |  RFC 3279 |
        |       "md5"        |   1.2.840.113549.2.5   |  RFC 3279 |
        |      "sha-1"       |     1.3.14.3.2.26      |  RFC 3279 |
        |     "sha-224"      | 2.16.840.1.101.3.4.2.4 |  RFC 4055 |
        |     "sha-256"      | 2.16.840.1.101.3.4.2.1 |  RFC 4055 |
        |     "sha-384"      | 2.16.840.1.101.3.4.2.2 |  RFC 4055 |
        |     "sha-512"      | 2.16.840.1.101.3.4.2.3 |  RFC 4055 |
        +--------------------+------------------------+-----------+"

Christer's suggestion: Keep the above text, without changes. This is the initial IANA registration, and we don't change that.

Regards,

Christer

-----Original Message-----
From: Martin Thomson [mailto:[email-masked]] 
Sent: 04 January 2017 00:07
To: Roman Shpount <[email-masked]>
Cc: Cullen Jennings <[email-masked]>; Jonathan Lennox <[email-masked]>; [email-masked]; Christer Holmberg <[email-masked]>
Subject: Re: [MMUSIC] draft-4572-update: Spec contains references to a number of obsoleted RFCs

On 4 January 2017 at 04:44, Roman Shpount <[email-masked]> wrote:
> specification should state that they MUST NOT be used. This way there 
> are no potential backwards interop problems.

To address Christer's original concern, I would say that you don't need a reference to the algorithms to achieve that.  An informative reference is as far as you might go.

---

From: Roman Shpount <[email-masked]>
Date: Wed, 4 Jan 2017 09:31:19 -0500

This looks good to me

_____________
Roman Shpount

On Wed, Jan 4, 2017 at 6:22 AM, Christer Holmberg <
[email-masked]> wrote:

> Ok, to make sure we are all on the same page, below are the places in the
> previous version (-08) of the draft where MD2 and MD5 are mentioned, and my
> suggestion on what/if to do:
>
>
> Section 5:
> -------------
>
> Christer's suggestion: Keep the text, but update the MD2 and MD5
> references ([3] and [4]), and add the following new paragraph text:
>
> "For backward compatibility with implementations compliant with RFC 4572,
> the MD2 and MD5 cipher suite are still listed in the syntax. However,
> implementations compliant to this specification MUST NOT use them."
>
>
> Section 8:
> -------------
>
> Christer's suggestion: Keep the above text, without changes. This is the
> initial IANA registration, and we don't change that.
>
>
> Regards,
>
> Christer
>
>
>
>
> Cc: Cullen Jennings <[email-masked]>; Jonathan Lennox <[email-masked]>;
> [email-masked]; Christer Holmberg <[email-masked]>
> To address Christer's original concern, I would say that you don't need a
> reference to the algorithms to achieve that.  An informative reference is
> as far as you might go.
>

---

From: Christer Holmberg <[email-masked]>
Date: Thu, 5 Jan 2017 13:16:36 +0000

Ok, I’ll submit a new version (-10) based on the changes below.

Regards,

Christer

From: Roman Shpount [mailto:[email-masked]]
Sent: 04 January 2017 16:31
To: Christer Holmberg <[email-masked]>
Cc: Martin Thomson <[email-masked]>; Cullen Jennings <[email-masked]>; Jonathan Lennox <[email-masked]>; [email-masked]
Subject: Re: [MMUSIC] draft-4572-update: Spec contains references to a number of obsoleted RFCs

This looks good to me

_____________
Roman Shpount

On Wed, Jan 4, 2017 at 6:22 AM, Christer Holmberg <[email-masked]<mailto:[email-masked]>> wrote:
Ok, to make sure we are all on the same page, below are the places in the previous version (-08) of the draft where MD2 and MD5 are mentioned, and my suggestion on what/if to do:

Section 5:
-------------

-------------

Section 8:
-------------

Regards,

Christer