Subject: RE: DNSEXT WG Last Call: TSIG/SHA document

From: Eastlake III Donald-LDE008 <[email-masked]>
Date: Tue, 1 Mar 2005 17:01:47 -0500

By "level of implementation requirement" I meant
optional/recommended/mandatory.

The draft has three mandatory algorithms, HMACs MD5, SHA-1, and
SHA-256 which is unusual for an IETF standard, but may be
justified in this case. All others are optional.

Donald

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of Mark Andrews
Sent: Tuesday, March 01, 2005 4:35 PM
To: Donald Eastlake III
Cc: [email-masked]
Subject: Re: DNSEXT WG Last Call: TSIG/SHA document 

> Needless to say, I support the document but enough requests have been=20
> posted for some more security guidance that I think I should revise it=20
> once more and post after the IETF meeting. Guidance as to the level of
> implementation requirement for varous hash functions would be
> appreciated or should they just be left as they are in the current
> draft?

	The document had enough detail to implement non-truncated
	hash functions.
 
> There is some mention in the document of weaknesses being found in hash=20
> algorithms recently. I suppose it should say a little more but I do not=20
> see any reason to expand substantially on that or try to make the draft=20
> into a treatise on the subject.
> 
> From the draft:                                        "increasingly
>     successful cryptanalytic attacks are being made on the shorter
>     hashes"

Also from the draft:
   "Significant progress has been made recently in cryptanalysis of hash
   function of the type used herein. While the results so far should not
   effect HMAC, the stronger SHA-1 and SHA-256 algorithms are being made
   mandatory due to caution."

> Thanks,
> Donald

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Mark Andrews <[email-masked]>
Date: Wed, 02 Mar 2005 09:25:08 +1100

> justified in this case. All others are optional.

	I'm fine w/ the existing levels.  I suspect most will
	just implement them all as it is not much extra work
	once you implement one.
 
--
Mark Andrews, ISC
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: +61 2 9871 4742                 INTERNET: [email-masked]