Subject: [MSEC] Consensus call on draft-ietf-msec-ipsec-signatures-05.txt

From: Lakshminath Dondeti <[email-masked]>
Date: Tue, 31 May 2005 16:31:01 -0400

Hi all,

As you might know, there were some comments during the IESG last call on 
msec-ipsec-signatures-05 document that Brian Weis is editing/authoring.  
Specifically, the following points were raised and, in -05-, have been 
addressed by Brian.  Please review and send comments to the list before 
June 1, 2005.

1. 04 uses encryption schemes for signing as opposed to signature schemes:

This has been fixed in the revised version (please see Section 2.0).  
Instead of RSAES-PKCS1-v1_5, the draft specifies the use of 
RSASSA-PKCS1-v1_5.

2. There was a suggestion to use PSS padding instead of PKCS1-v1_5.

Section 2.0 now specifies that RSASSA-PKCS1-v1_5 is a MUST (no change 
here except for Item #1 above),
and that RSASSA-PSS is a SHOULD.  There is an explanation as to why PSS 
is not a MUST.

3.  Section 2.0 also contains details on how to sign packets.

4.  The draft now specifies "A conforming implementation MUST support a 
modulus size of 1024 bits" in Section 2.0.

5. Section 4.0 contains new text on combined modes and states in part
"The RSA signatures algorithm cannot be used with an ESP Combined Mode 
algorithm that includes an explicit ICV."

There is an explanation as to why.

6. Now that there is a choice in RSA signature padding schemes, Section 
5.0 specifies "Signature Encoding Algorithm SA Attribute" as part of the 
SA policy download.

7. Section 7.0 now contains IANA considerations for the Signature 
Encoding Algorithm Attribute.

Please review all the changes and send your comments to the list.  We 
would like to hear if you agree with, don't agree with, or don't care 
about the changes. 

(Please also indicate if anyone needs more time to review)

thanks and regards,
Lakshminath

[email-masked] wrote:

>A New Internet-Draft is available from the on-line Internet-Drafts directories.
>This draft is a work item of the Multicast Security Working Group of the IETF.
>
>	Title		: The Use of RSA/SHA-1 Signatures within ESP and AH
>	Author(s)	: B. Weis
>	Filename	: draft-ietf-msec-ipsec-signatures-05.txt
>	Pages		: 11
>	Date		: 2005-5-26
>	
>This memo describes the use of the RSA Digital Signature algorithm as 
>   an authentication algorithm within the revised IP Encapsulating 
>   Security Payload (ESP) as described in RFC XXXX and the revised IP 
>   Authentication Header (AH) as described in RFC YYYY. The use of a 
>   digital signature algorithm, such as RSA, provides data origin 
>   authentication in applications when a secret key method (e.g., HMAC) 
>   does not provide this property. One example is the use of ESP and AH 
>   to authenticate the sender of an IP multicast packet.
>
>A URL for this Internet-Draft is:
>http://www.ietf.org/internet-drafts/draft-ietf-msec-ipsec-signatures-05.txt
>
>To remove yourself from the I-D Announcement list, send a message to 
>[email-masked] with the word unsubscribe in the body of the message.  
>You can also visit https://www1.ietf.org/mailman/listinfo/I-D-announce 
>to change your subscription settings.
>
>
>Internet-Drafts are also available by anonymous FTP. Login with the username
>"anonymous" and a password of your e-mail address. After logging in,
>type "cd internet-drafts" and then
>	"get draft-ietf-msec-ipsec-signatures-05.txt".
>
>A list of Internet-Drafts directories can be found in
>http://www.ietf.org/shadow.html 
>or ftp://ftp.ietf.org/ietf/1shadow-sites.txt
>
>
>Internet-Drafts can also be obtained by e-mail.
>
>Send a message to:
>	[email-masked].
>In the body type:
>	"FILE /internet-drafts/draft-ietf-msec-ipsec-signatures-05.txt".
>	
>NOTE:	The mail server at ietf.org can return the document in
>	MIME-encoded form by using the "mpack" utility.  To use this
>	feature, insert the command "ENCODING mime" before the "FILE"
>	command.  To decode the response(s), you will need "munpack" or
>	a MIME-compliant mail reader.  Different MIME-compliant mail readers
>	exhibit different behavior, especially when dealing with
>	"multipart" MIME messages (i.e. documents which have been split
>	up into multiple messages), so check your local documentation on
>	how to manipulate these messages.
>		
>		
>Below is the data which will enable a MIME compliant mail reader
>implementation to automatically retrieve the ASCII version of the
>Internet-Draft.
>  
>
>------------------------------------------------------------------------
>
>_______________________________________________
>I-D-Announce mailing list
>[email-masked]
>https://www1.ietf.org/mailman/listinfo/i-d-announce
>  
>
_______________________________________________
msec mailing list
[email-masked]
http://six.pairlist.net/mailman/listinfo/msec