Subject: Authentication

From: Chris Nogradi <[email-masked]>
Date: Thu, 17 Mar 2005 09:08:53 -0500

Dave,

I just noticed that you have added the following sentence to the base draft in 
section 6.6:

"Implementations MUST support SHA1 authentication.  Other froms of 
authentication are optional."

Since you did not make mention of this in the document changes sections, I 
assume that this does not mean that all implementations must support at least 
this form of authentication.  Is the purpose of this sentence to say that if 
an implementation uses authentication, it must support SHA1?

BTW, there is a typo in this sentence as it should say "forms" instead of 
"froms".

Thanks,

Chris

---

From: Pekka Savola <[email-masked]>
Date: Thu, 17 Mar 2005 17:42:53 +0200 (EET)

> an implementation uses authentication, it must support SHA1?

I think this makes sense.  In any case, security area typically will 
not accept any new protocols which don't support SHA1 -- and further, 
there must be at least one mandatory-to-implement security mechanisms 
so different implementations will be able to interoperate.

-- 
Pekka Savola                 "You each name yourselves king, yet the
Netcore Oy                    kingdom bleeds."
Systems. Networks. Security. -- George R.R. Martin: A Clash of Kings

---

From: Dave Katz <[email-masked]>
Date: Thu, 17 Mar 2005 11:29:17 -0700

> an implementation uses authentication, it must support SHA1?

Sorry, I forgot to list that in the changes.

This is in there because the IESG will not allow the document to 
advance without it.  It's an interesting question as to whether they 
would allow the spec to say that an implementation could have no 
authentication at all;  my guess is that their stand is that the spec 
must require that all implementations support SHA1 authentication.

I also expect that vendors will make their own choices, as there is no 
significant difference between an implementation in which nobody turns 
on authentication and an implementation that does not even include it.

But that's the word from on high.

> BTW, there is a typo in this sentence as it should say "forms" instead 

Thanks...

--Dave

---

From: Dave Katz <[email-masked]>
Date: Thu, 17 Mar 2005 11:31:01 -0700

On Mar 17, 2005, at 8:42 AM, Pekka Savola wrote:

> In any case, security area typically will not accept any new protocols 
> which don't support SHA1 -- and further, there must be at least one 
> mandatory-to-implement security mechanisms so different 
> implementations will be able to interoperate.

Yep.  Luckily they are protocol police, not implementation police.

--Dave