Subject: Re: trying to close Editor's Question Q-29

From: Samuel Weiler <[email-masked]>
Date: Wed, 11 Feb 2004 01:34:58 -0500 (EST)

Repeating what I said when I started this discussion on 15 January:

I think SHOULD is perfectly correct.

Scott suggests:

> > "SHOULD be rejected, but MAY use RRSIGs if other security
> > checks were successful, depending on local policy".

Using the language of Q-28 (which may change slightly), I think five
words are sufficient: "SHOULD be treated as bogus."  The MAY is
implicit.

>     roy> The only way caches are protected against replay is current
>     roy> time check. It is part of the crypto-layer.
>
Jim> In that case, a MUST is needed, not a SHOULD.

Disagree.  This is a 2119 "SHOULD" -- ignore at your own peril and
only after due consideration (Really.  We mean it.), but you're not
hurting anyone other than yourself.

-- Sam

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: [email-masked]
Date: Wed, 11 Feb 2004 09:59:48 +0100 (CET)

> Repeating what I said when I started this discussion on 15 January:

Repetitive statements does not make your argument more true.

> I think SHOULD is perfectly correct.

You were wrong then, you are wrong now.

You wrote: "To accomodate local policy, I think these should be SHOULD
NOTs." in your january 15th mail.

You are using "local policy" as magic paint to ram your view of the
robustness principle into a validator. ANY policy that allows treating
expired signatures as valid is BAD policy.

The validator validates, checking the time stamp is part of the
validation. It's as old at 2065 (6.4 Secure Time). Its in 2535 (6.4
Secure Time). Why change it now ?

> words are sufficient: "SHOULD be treated as bogus."  The MAY is

Repetitive statement.
Repetitive statement.

> hurting anyone other than yourself.

The exact meaning of MUST applies perfectly:

MUST	This word, or the terms "REQUIRED" or "SHALL", mean that the
   	definition is an absolute requirement of the specification.

This is an absolute requirement. A dealbreaker. Protecting against replay.
If this is a SHOULD the system is less secure. I can sign data with a Very
Large Key and a Very Short Validity Period. If some implementation has a
switch that allows end users to TRUST MY DATA while MY DATA IS BOGUS due
to expiration, then that switch is illegal. If that switch is legal, all
bets are off.

Change local time as a workaround to have a system validate old
signatures. Don't hack the spec to allow for this.

Roy

---

From: Miek Gieben <[email-masked]>
Date: Wed, 11 Feb 2004 12:24:16 +0100

[On 11 Feb, @07:34, Samuel wrote in "Re: trying to close Editor's Q ..."]
> words are sufficient: "SHOULD be treated as bogus."  The MAY is

after reading 2119, I wholehearted agree that these 5 words are
enough,

grtz Miek