Subject: DNSEXT WGLC Summary: TSIG SHA1 document (version #2)

From: Ólafur Guðmundsson /DNSEXT co-chair <[email-masked]>
Date: Tue, 22 Mar 2005 15:13:34 -0500

The working group last call has concluded.
The document was reviewed by working group members and security
area directorate member.
The working group supports the document advancement.

Following changes/clarifications are needed in the document
before it is advanced.

#1 Add text saying implementations can reject messages signed by a
particular algorithm even if that algorithm is mandatory to implement.
(important in TKEY environments where there is no human involved in
negotiating the algorithm type).

#2 Set lower bound on truncation (for each algorithm),
default lower bound is half of original digest. i.e. text should
read "MUST NOT accept signatures truncated to half or less of digest".

#3 add new TSIG error code that sender is using excessive truncation

#4 add text saying responder MUST use same truncation as sender.

#5 Remove unused reference to 2434

#6 Add text that defines what is included in subsequent digest when
truncation is used (full or truncated digest)

After the document is updated there will be a 2 week review period before
the chairs will advance the document to the IESG.

	Olafur

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>