Subject: [OPSAWG] Last Call: <draft-ietf-opsawg-hmac-sha-2-usm-snmp-05.txt> (HMAC-SHA-2 Authentication Protocols in USM for SNMP) to Proposed Standard

From: The IESG <[email-masked]>
Date: Mon, 06 Apr 2015 09:33:26 -0700

The IESG has received a request from the Operations and Management Area
Working Group WG (opsawg) to consider the following document:
- 'HMAC-SHA-2 Authentication Protocols in USM for SNMP'
  <draft-ietf-opsawg-hmac-sha-2-usm-snmp-05.txt> as Proposed Standard

The IESG plans to make a decision in the next few weeks, and solicits
final comments on this action. Please send substantive comments to the
[email-masked] mailing lists by 2015-04-20. Exceptionally, comments may be
sent to [email-masked] instead. In either case, please retain the
beginning of the Subject line to allow automated sorting.

Abstract

   This memo specifies new HMAC-SHA-2 authentication protocols for the
   User-based Security Model (USM) for SNMPv3 defined in RFC 3414.

The file can be obtained via
http://datatracker.ietf.org/doc/draft-ietf-opsawg-hmac-sha-2-usm-snmp/

IESG discussion can be tracked via
http://datatracker.ietf.org/doc/draft-ietf-opsawg-hmac-sha-2-usm-snmp/ballot/

No IPR declarations have been submitted directly on this I-D.

---

From: t.petch <[email-masked]>
Date: Tue, 14 Apr 2015 15:51:11 +0100

Warren

I am used to seeing downrefs called out in the IETF Last Call notice.

This I-D certainly has them but the Last Call notice makes no mention of
them.  Is this ok?

Tom Petch

----- Original Message -----
From: "The IESG" <[email-masked]>
To: "IETF-Announce" <[email-masked]>
Cc: <[email-masked]>
Sent: Monday, April 06, 2015 5:33 PM

> IESG discussion can be tracked via
http://datatracker.ietf.org/doc/draft-ietf-opsawg-hmac-sha-2-usm-snmp/ba
llot/

---

From: Warren Kumari <[email-masked]>
Date: Tue, 14 Apr 2015 11:45:54 -0400

> This I-D certainly has them but the Last Call notice makes no mention of

I believe so -- the document shepherd writeup has a specific section
for downrefs:
"(15) Are there downward normative references references (see RFC
3967)? If so, list these downward references to support the Area
Director in the Last Call procedure."

and the downrefs are listed in the full writeup:

"(15) Are there downward normative references references (see RFC 3967)?

** YES **

Normative reference to an Informational RFC 2104 Non-RFC normative reference
'SHA' Normative reference to an Informational RFC 6234

RFC 2104 and RFC 6234 are in the downregreg (which is currently throwing 500
Errors) SHA references: National Institute of Standards and Technology,
"Secure Hash Standard (SHS)", FIPS PUB 180-4, March 2012. Note that RFC2014
and RFC6234 also reference versions of this document.
"

I do not think that the downrefs (especially ones that are well known)
are usually listed in the LC.

W

-- 
I don't think the execution is relevant when it was obviously a bad
idea in the first place.
This is like putting rabid weasels in your pants, and later expressing
regret at having chosen those particular rabid weasels and that pair
of pants.
   ---maf

---

From: joel jaeggli <[email-masked]>
Date: Wed, 15 Apr 2015 21:12:19 -0700

> This I-D certainly has them but the Last Call notice makes no mention of

I gave this a little (not a lot) of thought during the ad review.

My interpretation was that downrefs to rfc 2104 are sufficiently
ubiquiious to not merit further discussion let alone further review.  if
that's not an universaly held opinion I suppose we should hear that.

both it and 6234 have visited the downref registry previously in 2104's
case there are something like 200 references to it from subsequent RFCs.

if the secdir would like to start a shooting war over references to HMAC
(which I doubt) I'll respect that but it's not really my wheelhouse.

thanks
joel

> _______________________________________________
> OPSAWG mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/opsawg
>