Subject: DISCUSS and COMMENT: draft-ietf-radext-status-server

From: "Bernard Aboba" <[email-masked]>
Date: Tue, 20 Apr 2010 14:00:54 -0700

-----Original Message-----
From: Peter Saint-Andre [mailto:[email-masked]] 
Sent: Tuesday, April 20, 2010 11:31 AM
To: [email-masked]
Cc: [email-masked]; [email-masked]; [email-masked]
Subject: DISCUSS and COMMENT: draft-ietf-radext-status-server 

Discuss:
Is the use of MD5 in generating the Response Authenticator subject to collision attacks? If not, it would be helpful to describe why not, and provide a reference to RFC 4270. If so, then the security considerations need to be updated.

Comment:
Given that the Request Authenticator should be unpredictable and unique, a reference to RFC 4086 would be appropriate.

Please add a reference to RFC 1321 for the definition of MD5.

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://psg.com/lists/radiusext/>