Subject: how to deprecate HMAC-MD5 TSIG

From: Francis Dupont <[email-masked]>
Date: Tue, 06 May 2008 11:52:42 +0200

I don't know if dnsext is the right working group, dnsop is a candidate
but the document to amend is a dnsext one. The saag is another candidate
but is not as far as I know a formal working group (I've copied this mail
to the security area directors anyway).

The idea is to deprecated the HMAC-MD5 algorithm is TSIG. It is
registered by IANA as "HMAC-MD5.SIG-ALG.REG.INT" and the RFC 4635
which specifies the HMAC-SHA* keeps it as "mandatory" to implement.

The TSIG Algorithms are under the IETF Consensus policy so IMHO
we should publish a document which:
 - deprecate HMAC-MD5.SIG-ALG.REG.INT in the IANA registery
 - make its implementation optional (MUST -> MAY)
 - make its use NOT RECOMMENDED
but how to proceed in details?

Regards

[email-masked]

PS: the RFC 3110 deprecated the RSA/MD5 algorithm for (DNS)KEY and (RR)SIG RRs.

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Ólafur Guðmundsson /DNSEXT chair <[email-masked]>
Date: Tue, 06 May 2008 07:57:43 -0400

Write draft-dupont-dnsext-tsig-md5-obsolete-00.txt
that updates RFC2445 saying basically what you say below.
DNSEXT will process the document.

         Olafur

---

From: Scott Rose <[email-masked]>
Date: Tue, 06 May 2008 09:11:41 -0400

Personally, I support this effort, even if the product is a very short 
internet-draft.  DNSEXT is the correct place I believe since it is not 
just an operational change.

Scott

-- 
----------------------------------------
Scott Rose            Computer Scientist
NIST
ph: +1 301-975-8439
[email-masked]

http://www-x.antd.nist.gov/dnssec
http://www.dnsops.gov/
-----------------------------------------