Subject: Re: FTP Extensions for Cryptographic Hashes (draft-bryan-ftp-hash)

From: "William F. Maton Sotomayor" <[email-masked]>
Date: Tue, 6 Apr 2010 09:00:49 -0400 (EDT)

Hi Anthony

 	Nice draft.  FYI, I'm semi-maintaining the venerable wu-ftpd codebase, 
largely for my own purposes as well as to collate the various patches I have 
come across the 'net.  FYI, wu-ftpd supprts the following to do something 
similar (I think it's had that for ages now?) :

     | SITE check_login SP CHECKMETHOD SP method CRLF
     | SITE check_login SP CHECKMETHOD CRLF
     | SITE check_login SP CHECKSUM SP pathname CRLF
     | SITE check_login SP CHECKSUM CRLF

Right now the code 'cheats' its way to doing it like this:

1) Which ones we support:

         reply(200, "Current checksum method: MD5 (RFC1321)");
         reply(200, "Current checksum method: CRC (POSIX)");

2) Making calls to installed programs in the paths.

And of course in English:

o  Added 'SITE CHECKMETHOD' and 'SITE CHECKSUM'.

         SITE CHECKMETHOD [CRC|POSIX|MD5|RFC1321]

 	Sets or displays the current check method.  If no parameter is
 	given, displays the current method; otherwise the method is set to
 	the given algorithm.  CRC and POSIX are equivalent and are the
 	output of the GNU cksum(1) utility.  MD5 and RFC1321 are equivalent
 	and are the output of the GNU md5sum(1) utility.  The default check
 	method is RFC1321 (MD5).

 	SITE CHECKSUM [<file>]

 	Calculates the checksum for the named file.  If no file is given,
 	the last file transferred (uploaded or download) is used.  If no
 	file has yet been transferred, reports an error.  The current
 	CHECKMETHOD is used to calculate the checksum.

Looking at the code it seems to have been introduced sometime in 1998.

FYI, more on this at my site:

 	http://www.wfms.org/wu-ftpd/

I'll have a second look at your draft and see if I can offer up any more 
comments.  Thanks!

On Wed, 24 Mar 2010, Anthony Bryan wrote:

> Hi,
> 
> This ID proposes a feature where FTP clients can request the hash of a
> file. A number of FTP clients and servers have implemented multiple
> commands (XMD5, XSHA1, SITE SHOHASH, etc) that are not formally
> specified, leading to non-interoperability and confusion.
> 
> We have talked to FTP application authors that are interested in this
> feature. Others have previously resisted implementing this feature
> because it isn't formally specified.
> 
> We already have some issues from Alfred Hoenes and John Klensin to
> address. If you are interested, please review & reply.
> 
> thanks,
> -- 
> (( Anthony Bryan ... Metalink [ http://www.metalinker.org ]
>  )) Easier, More Reliable, Self Healing Downloads
> 
> 
> A new version of I-D, draft-bryan-ftp-hash-00.txt has been
> successfully submitted by Anthony Bryan and posted to the IETF
> repository.
> 
> Filename:        draft-bryan-ftp-hash
> Revision:        00
> Title:           FTP Extensions for Cryptographic Hashes
> Creation_date:   2010-03-23
> WG ID:           Independent Submission
> Number_of_pages: 7
> 
> Abstract:
> The specification for the File Transfer Protocol does not include
> methods to obtain cryptographic hashes of files.  Cryptographic
> hashes can be used to identify files and verify integrity.
> Unfortunately, because of the desire for this feature, multiple
> commands that are not formally specified have been implemented in FTP
> applications leading to non-interoperability and confusion.  This
> specification documents an optional command where FTP clients can
> request the cryptographic hash of a file from a FTP server.
> _______________________________________________
> Apps-Discuss mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/apps-discuss
>

wfms

---

From: Anthony Bryan <[email-masked]>
Date: Mon, 12 Apr 2010 00:59:42 -0400

On Tue, Apr 6, 2010 at 9:00 AM, William F. Maton Sotomayor
<[email-masked]> wrote:
>
> Hi Anthony
>
>        Nice draft.  FYI, I'm semi-maintaining the venerable wu-ftpd
> codebase, largely for my own purposes as well as to collate the various
> patches I have come across the 'net.  FYI, wu-ftpd supprts the following to
> do something similar (I think it's had that for ages now?) :
>

Hi William, great to hear from someone familiar with current
implementations! (I added wuftpd to the appendix listing apps
supporting alternate hash commands).

We've put out an -01 revision, and you can see diffs here.

tools.ietf.org/html/draft-bryan-ftp-hash

If you have any more comments, please let us know.
-- 
(( Anthony Bryan ... Metalink [ http://www.metalinker.org ]
  )) Easier, More Reliable, Self Healing Downloads