Subject: draft-ietf-secsh-dns-01.txt Fingerprint digest alg

From: Darren J Moffat <[email-masked]>
Date: Thu, 7 Nov 2002 07:17:10 -0800 (PST)

3.1.2 Fingerprint type specification

The only digest algorithm listed is SHA1. I think this is inconsistant with
draft-ietf-secsh-fingerprint-01.txt (expired) which specified MD5 as
the fingerprint digest algorithm.

While we are on the subject is there an update to
draft-ietf-secsh-fingerprint-01.txt expected since it has now been removed
from the IETF site.

-- 
Darren J Moffat

---

From: Jakob Schlyter <[email-masked]>
Date: Thu, 7 Nov 2002 16:25:57 +0100 (CET)

> the fingerprint digest algorithm.

yes, that is intentional - I can not see any reason for using md5.

	jakob

-- 
Jakob Schlyter <[email-masked]>                Network Analyst
Phone:  +46 31 701 42 13, +46 70 595 07 94   Carlstedt Research & Technology

---

From: [email-masked]
Date: Thu, 7 Nov 2002 16:37:43 +0100 (CET)

> yes, that is intentional - I can not see any reason for using md5.

Wouldn't backwards compatibility be better served by requiring SHA1 and
additionally recommending MD5 be provided?  Better to allow users to check 
key fingerprints using a slightly less secure algorithm than prevent them 
from checking key fingerprints against servers who aren't yet up to date 
with the latest and greatest, no?

-- 
Jon Bright
Lead Programmer, Silicon Circus Ltd.
http://www.siliconcircus.com

---

From: Jakob Schlyter <[email-masked]>
Date: Thu, 7 Nov 2002 16:43:37 +0100 (CET)

On Thu, 7 Nov 2002 [email-masked] wrote:

> additionally recommending MD5 be provided?

there is nothing to be backwards compatible with since sshfp isn't yet
deployed.

users will not verify the fingerprints distributed with sshfp themselves,
their software will. why? since without dnssec validation, sshfp is
practically useless and verifying the dnssec signature of the sshfp
manually isn't doable.

	jakob

---

From: Markus Friedl <[email-masked]>
Date: Thu, 7 Nov 2002 22:27:26 +0100

> yes, that is intentional - I can not see any reason for using md5.

well we've been using md5 in openssh forever. it's because ossh
only had md5 support and not sha1.

---

From: Markus Friedl <[email-masked]>
Date: Thu, 7 Nov 2002 22:27:57 +0100

> draft-ietf-secsh-fingerprint-01.txt expected since it has now been removed

i can update the drafts, but i think it's too late for the next ietf meeting.

---

From: Jakob Schlyter <[email-masked]>
Date: Thu, 7 Nov 2002 22:30:21 +0100 (CET)

> only had md5 support and not sha1.

let me clarify this; I can not see any reason for using md5 in sshfp. I
can of course change my mind if the wg strongly believes that md5 should
be an option.

	jakob