Subject: Re: [ntpwg] draft-ietf-ntp-cms-for-nts-message

From: [email-masked]
Date: Thu, 17 Mar 2016 12:08:53 +0100

Hello all,

a while ago we had some input from Jim Schaad, the conversation is cited 
below.
I would like to make known that it has been considered and the drafts have 
been changed accordingly, in the direction of "MAC algorithm" rather than 
the more specific "HMAC algorithm". 
The resulting text is going to be included in the next draft version 
submission.

Best regards,
Kristof

"Jim Schaad" <[email-masked]> schrieb am 09.03.2016 21:57:00:

> Von: "Jim Schaad" <[email-masked]>
> An: "'Russ Housley'" <[email-masked]>, <[email-masked]>
> Kopie: <[email-masked]>
> Datum: 09.03.2016 21:57
> Betreff: RE: draft-ietf-ntp-cms-for-nts-message
> 
> I don?t believe that the changes for negotiation should be any 
> different than they are today.  You are just going to negotiate a 
> MAC algorithm rather than a DIGEST algorithm.  The set of algorithms
> does not need to be changed.  The changes ae as simple as changing 
> the sentence in section 7.3 from
> 
> OLD
> The HMAC is generated with the hash algorithm specified by the 
> client (see Section 7.2)
> 
> NEW
> The HMAC is generated with the HMAC algorithm specified by the 
> client (see section 7.2).
> 
> If you want to be more forward looking, then it would be
> 
> The MAC is generated with the MAC algorithm specified by the client 
> (section 7.2)
> 
> But that can easily be done in a future revision.  The whole object 
> is to make sure that you have the path open in the future not that 
> you follow the path today. 
> 
> I had to look to see if the cookie was calculated with a hash or a 
> MAC based on the text from 7.2.  However it does appear that it does
> use a MAC algorithm so there would be no drastic changes for that 
> text as well.
> 
> 
> Jim
> 
> 
> From: Russ Housley [mailto:[email-masked]] 
> Sent: Wednesday, March 09, 2016 12:36 PM
> To: [email-masked]
> Cc: [email-masked]; Jim Schaad 
> <[email-masked]>
> Subject: Re: draft-ietf-ntp-cms-for-nts-message
> 
> I think that Jim is just asking that the field be named in a way 
> that lets an algorithm transition in the future.  The timing is your 
call.
> 
> Russ
> 
> 
> On Mar 9, 2016, at 4:18 AM, [email-masked] wrote:
> 

> Russ 
> 
> from our point of view there is no real reason not to include the 
> suggested changes. Apart from the CMS-draft we shall have to 
> introduce additional changes at least to the draft-ietf-network-
> time-security in order to make non hmac  MAC algorithm negotiable. 
> 
> We shall send you the proposed changes in the CMS draft  and also 
> include  the proposed ASN.1 module additions. 
> 
> Dieter
> 
> -------------------------------------
> Dr. Dieter Sibold
> Physikalisch-Technische Bundesanstalt
> Q.42 - Serversysteme und Datenhaltung
> QM-Verantwortlicher der Stelle IT
> Bundesallee 100 
> D-38116 Braunschweig
> Tel:    +49-531-592-84 20
> E-Mail: [email-masked]
> 
> 
> Russ Housley <[email-masked]> schrieb am 09.03.2016 00:34:50:
> 
> > Von: Russ Housley <[email-masked]> 
> > An: "Jim Schaad" <[email-masked]> 
> > Kopie: <[email-masked]> 
> > Datum: 09.03.2016 00:35 
> > Betreff: Re: draft-ietf-ntp-cms-for-nts-message 
> > 
> > Jim:
> > 
> > That is a pretty simple change.  I support it.
> > 
> > Do the other authors of this document agree?
> > 
> > Russ
> > 
> > 
> > On Mar 8, 2016, at 3:53 PM, Jim Schaad wrote:
> > 
> > > This draft popped up for an early review of content types due to the 
fact
> > > that it is going to be released soon in OPENSSL.  I would like to 
strongly
> > > push back on one of the features that is being placed in the 
> structures for
> > > algorithm selection.
> > > 
> > > You are fixing thing to only use HMAC by using the term 
> hmacHashAlgos.  What
> > > happens when NIST produces a MAC algorithm using the SHA-3 hash 
functions
> > > which does not require HMAC?  Is there a reason for not making 
> this field a
> > > set of MAC algorithm identifiers?  RFC 4231 defines HMAC OIDs 
> for all of the
> > > SHA-2 algorithms and RFC 3370 defines the same for SHA-1.
> > > 
> > > Also, I experience a small irritation that you are not using 
authenticated
> > > encryption but that is somewhat understandable.
> > > 
> > > Jim

_______________________________________________
ntpwg mailing list
[email-masked]
http://lists.ntp.org/listinfo/ntpwg