Subject: Re: [tram] [Technical Errata Reported] RFC8489 (6268)

From: Marc Petit-Huguenin <[email-masked]>
Date: Mon, 5 Oct 2020 04:59:58 -0700

Hi Magnus,

I still think that this errata misrepresents the purpose of the test-vector.  But anyway Ren Thraysk provided an updated test vector, so you have everything you need to update the errata.

Thanks.

On 9/30/20 1:45 AM, Magnus Westerlund wrote:
> On Mon, 2020-09-28 at 07:54 -0700, Marc Petit-Huguenin wrote:
>> On 9/28/20 7:36 AM, Magnus Westerlund wrote:
>>> Hi,
>>>
>>> A question here. Is the key used in the MESSAGE-INTEGRITY-SHA256 the MD5
>>> derived
>>> one, or one derived using SHA256? If it is the former, then fine the lets
>>> just
>>> add a sentence of clarification as the option exist. But, Jared's previous
>>> comments appear to indicate the the key for the HMAC-SHA256 used in the
>>> intergrity was derived using SHA256. If it is the later, then I don't see
>>> any
>>> option than to include the password algorithm attribute and its algorithm
>>> indicator as it is a necessary component to correctly derive the key and
>>> thus
>>> being able to verify the MESSAGE-INTEGRITY. 
>>
>> SHA256.
> 
> So in this case then the PASSWORD-ALGORITM attribute is required unless I
> missinterpret the RFC. I understand that there is some work in preparing the
> message and calculate the integrity. However, in this case it is necessary
> information and a mandated value so can you please prepare a new message with
> the attribute include indicating the correct value?
> 
> 
> Cheers
> 
> Magnus Westerlund 
> 

-- 
Marc Petit-Huguenin
Email: [email-masked]
Blog: https://marc.petit-huguenin.org
Profile: https://www.linkedin.com/in/petithug

---

From: Magnus Westerlund <[email-masked]>
Date: Mon, 19 Oct 2020 08:24:14 +0000

Hi Marc,

Your opinion is noted. However, I think a test vector and its description that 
do not contain all information necessary to test is flawed. And as the 
PASSWORD-ALGORITHM attribute is required when the non default algorithm is 
used, I think including it in the message was the right choice. If it hadn't 
been required, I think adding it just in the description text would have been 
sufficient.

I have edited and verified the errata. Thanks for your and Jared's work on 
this one.

Cheers

Magnus

> -----Original Message-----
> From: Marc Petit-Huguenin <[email-masked]>
> Sent: den 5 oktober 2020 14:00
> To: Magnus Westerlund <[email-masked]>;
> [email-masked]
> Cc: [email-masked]; [email-masked]; [email-masked]; dwing-
> [email-masked]; [email-masked]; [email-masked]
> Subject: Re: [tram] [Technical Errata Reported] RFC8489 (6268)
>
> Hi Magnus,
>
> I still think that this errata misrepresents the purpose of the test-vector. 
> But
> anyway Ren Thraysk provided an updated test vector, so you have
> everything you need to update the errata.
>
> Thanks.
>
> >>> A question here. Is the key used in the MESSAGE-INTEGRITY-SHA256 the
> >>> MD5 derived one, or one derived using SHA256? If it is the former,
> >>> then fine the lets just add a sentence of clarification as the
> >>> option exist. But, Jared's previous comments appear to indicate the
> >>> the key for the HMAC-SHA256 used in the intergrity was derived using
> >>> SHA256. If it is the later, then I don't see any option than to
> >>> include the password algorithm attribute and its algorithm indicator
> >>> as it is a necessary component to correctly derive the key and thus
> > So in this case then the PASSWORD-ALGORITM attribute is required
> > unless I missinterpret the RFC. I understand that there is some work
> > in preparing the message and calculate the integrity. However, in this
> > case it is necessary information and a mandated value so can you
> > please prepare a new message with the attribute include indicating the
> correct value?
> >
> >
> > Cheers
> >
> > Magnus Westerlund
> >
>
> --
> Marc Petit-Huguenin
> Blog: https://protect2.fireeye.com/v1/url?k=0253d662-5cf31424-025396f9-
> 86fc6812c361-cd3793f947751b4e&q=1&e=dd8e5a14-0502-4bdd-8bfa-
> 1a8054092e68&u=https%3A%2F%2Fmarc.petit-huguenin.org%2F