Subject: [RPSEC] about the charter and work items

From: [email-masked]
Date: Thu, 22 Jun 2006 10:08:53 -0400 (EDT)

Russ said that he was going to check about the status of charter changes.
I'd like also to mention one possible additional work item.  At the
mike at the last IETF, I mentioned taking on the draft that looks at
damage if MD5 is broken.  The response was that this was probably the
OSPF vulnerability analysis mentioned in the slides.  (Unfortunately,
this comment was too small to make it to the minutes, so I'm working
off memory here.)

But I was speaking of draft-manral-rpsec-existing-crypto-02.txt,
not the recently announced draft-ietf-rpsec-ospf-vuln-02.txt

I believe that there is value in looking at the damage to various
protocols that use keyed MD5 as an authentication mechanism - as an
impetus to change and as a warning to operators while MD5 is still used.
So I'm in favor of taking on the Manral draft.

Comments?

--Sandy

_______________________________________________
RPSEC mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/rpsec

---

From: Russ White <[email-masked]>
Date: Thu, 22 Jun 2006 20:07:46 -0400

> So I'm in favor of taking on the Manral draft.

I've been getting the ospf vulnerability draft and the existing crypto
drafts mixed up--how about if we ask both to be presented in Montreal,
and then think about (take a hum about) taking them on as WG items? I
think we might have already covered this space before (in terms of
taking them on as WG items), but it might be good to do a level set of
where we are, and what we need to work on.

:-)

Russ

---

From: Tony Tauber <[email-masked]>
Date: Fri, 23 Jun 2006 10:28:10 -0700 (PDT)

On Thu, 22 Jun 2006, Russ White wrote:

>> Russ said that he was going to check about the status of charter
>> changes.  I'd like also to mention one possible additional work
>> item.  At the mike at the last IETF, I mentioned taking on the
>> draft that looks at damage if MD5 is broken.  The response was that
>> this was probably the OSPF vulnerability analysis mentioned in the
>> slides.  (Unfortunately, this comment was too small to make it to
>> the minutes, so I'm working off memory here.)
>>
>> impetus to change and as a warning to operators while MD5 is still
>> used.  So I'm in favor of taking on the Manral draft.

I agree the Manral draft appears relevant, however, I'm not sure your
characterization of it's thrust is accurate.

The OSPF vulnerability draft is already a WG document.

As for presentation ideas for Montreal, bring 'em on.

Tony

> I've been getting the ospf vulnerability draft and the existing
> crypto drafts mixed up--how about if we ask both to be presented in
> Montreal, and then think about (take a hum about) taking them on as
> WG items? I think we might have already covered this space before
> (in terms of taking them on as WG items), but it might be good to do
> a level set of where we are, and what we need to work on.
>
> :-)
>
> Russ
>
>
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.1 (Darwin)
> Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org
>
> iD8DBQFEmzDRER27sUhU9OQRAt4RAJ9M62fBRabHyoDjPU3xGMycU8M9gACdEcpQ
> 2RzZrc/n+LTY/RVrJHogy28=
> =V/b+
> -----END PGP SIGNATURE-----
>