Subject: Re: Logical inconsistencies in draft-ietf-dnsext-tsig-md5-deprecated-00.txt

From: Francis Dupont <[email-masked]>
Date: Mon, 07 Jul 2008 17:31:16 +0200

In your previous mail you wrote:

   I could also live with moving HMAC-MD5 to 
   optional.  It is up to the parties involved to decide with algorithm to 
   use anyway.
   
=> I can go back to the word "optional" (BTW both are "not mandatory"
so translate to MAY implement). I believe this mailing-list is the right
place, or we can wait for Dublin?

Thanks

[email-masked]

PS: NIST'S POLICY ON HASH FUNCTIONS
March 15, 2006: *The SHA-2 family of hash functions (i.e., SHA-224,
SHA-256, SHA-384 and SHA-512) may be used by Federal agencies for all
applications using secure hash algorithms.* Federal agencies *should*
stop using SHA-1 for digital signatures, digital time stamping and
other applications that require collision resistance as soon as
practical, and must use the SHA-2 family of hash functions for these
applications after 2010. After 2010, Federal agencies may use SHA-1
only for the following applications: hash-based message authentication
codes (HMACs); key derivation functions (KDFs); and random number
generators (RNGs). Regardless of use, NIST encourages application and
protocol designers to use the SHA-2 family of hash functions for all
new applications and protocols.
(from http://csrc.nist.gov/groups/ST/hash/policy.html,
I've enclosed emphased words in the original by **)

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>