Subject: [DNSOP] RFC 2845bis and HMAC-MD5

From: Martin Hoffmann <[email-masked]>
Date: Thu, 14 Mar 2019 15:53:24 +0100

Hi,

when looking over draft-ietf-dnsop-rfc2845bis I was hoping that it
would relax the mandatory requirement for HMAC-MD5, but no such luck.

Given that most protocols have either made MD5 optional or banned it
outright, some modern crypto libraries have decided to drop it from
their supported algorithms. It seems to me that forcing new code to
include dependencies for MD5 is unnecessary.

As such, I would like to propose to move HMAC-MD5 to optional and only
retain SHA-1 and SHA-256 as mandatory.

Kind regards,
Martin

---

From: Tony Finch <[email-masked]>
Date: Thu, 14 Mar 2019 15:08:12 +0000

> retain SHA-1 and SHA-256 as mandatory.

That seems sensible. There should at the very least be a reference to
RFC6151, Updated Security Considerations for the MD5 Message-Digest and
the HMAC-MD5 Algorithms.

Tony.
-- 
f.anthony.n.finch  <[email-masked]>  http://dotat.at/
Shetland Isles: Variable 3 or less, becoming west or southwest 4 or 5,
occasionally 6 later. Moderate or rough. Showers. Moderate or good.

---

From: Matthew Pounsett <[email-masked]>
Date: Thu, 14 Mar 2019 14:56:29 -0400

> RFC6151, Updated Security Considerations for the MD5 Message-Digest and

Agreed.  I can't remember the last time I generated an HMAC-MD5 key .. and
I believe the default behaviour for most (all?) recent major distributions
default to something stronger (e.g. BIND now defaults to HMAC-SHA256).  Any
operators needing to support old key algorithms would be free to use
distributions that continue to optionally support them, or generate and
distribute new keys (something that should be done periodically anyway).

---

From: Dick Franks <[email-masked]>
Date: Thu, 14 Mar 2019 19:03:42 +0000

> RFC6151, Updated Security Considerations for the MD5 Message-Digest and

Is there any continuing justification for the special treatment of SHA-1
enshrined
in the footnote to Table 1.

Section 8 make abundantly clear that algorithm selection and applicable
truncation
is a matter of policy and agreement between client and server.  Taken
together with
the detailed requirements in section 6.5.2.1, and the statement that a
reply SHOULD
be sent with a MAC at least as long as that in the corresponding request,
removes
the need for specific numerical length constraints to be stated in this
document.

IMHO the SHOULD here should become MUST, promoting this to a full
requirement.

The special cases identified in 6.5.1 and 6.5.2 are obviously not subject
to the
general policy.

Security conscious users will define their policy having regard to
performance and
size versus strength trade-offs and weaknesses of particular algorithms
about which
there is no shortage of published material.

                 Requirement Name
                   ----------- ------------------------
                   Mandatory   HMAC-MD5.SIG-ALG.REG.INT
                   Optional    gss-tsig
                   Mandatory   hmac-sha1
                   Optional    hmac-sha224
                   Mandatory   hmac-sha256
                   Optional    hmac-sha384
                   Optional    hmac-sha512

                                  Table 1

   SHA-1 truncated to 96 bits (12 octets) SHOULD be implemented.

--Dick

---

From: Paul Wouters <[email-masked]>
Date: Fri, 15 Mar 2019 13:29:07 +0100

It’s too soon. Only a year or so again there was only hmac-md5

Sent from mobile device

> On Mar 14, 2019, at 15:53, Martin Hoffmann <[email-masked]> wrote:
> 
> Hi,
> 
> _______________________________________________
> DNSOP mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/dnsop

---

From: Tony Finch <[email-masked]>
Date: Fri, 15 Mar 2019 12:37:08 +0000

> It’s too soon. Only a year or so again there was only hmac-md5

I don't understand that comment ...

4635 HMAC SHA (Hashed Message Authentication Code, Secure Hash Algorithm)
     TSIG Algorithm Identifiers. D. Eastlake 3rd. August 2006. (Format:
     TXT=16533 bytes) (Updates RFC2845) (Status: PROPOSED STANDARD) (DOI:
     10.17487/RFC4635)

BIND got support in 9.5.0.

Tony.
-- 
f.anthony.n.finch  <[email-masked]>  http://dotat.at/
Forties, Cromarty, Forth, Tyne, Dogger: West 7 to severe gale 9, decreasing 6,
then becoming cyclonic later. Moderate or rough, occasionally very rough at
first in Forties and Dogger. Showers, rain later. Good, occasionally poor.