Subject: [tcpm] Re: SecDir review of draft-ietf-tcpm-syn-flood-03

From: Wesley Eddy <[email-masked]>
Date: Wed, 2 May 2007 09:05:56 -0400

On Wed, May 02, 2007 at 12:05:05PM +0300, [email-masked] wrote:
> I have reviewed this document as part of the security directorate's 
> ongoing effort to review all IETF documents being processed by the 
> IESG.  These comments were written primarily for the benefit of the 
> security area directors.  Document editors and WG chairs should treat 
> these comments just like any other last call comments.
> 
> Summary: Looks good!
> 
> One possible suggestion: the draft talks about using MD5 to calculate
> the cookies. Perhaps it would be a good idea to mention that other
> algorithms can be used instead (since the cookie is interpreted by the
> same host that generated it, using something else doesn't have to
> be negotiated etc.). This is kinda obvious once you've read and
> understood the whole document, but might be worth stating explicitly.
> 
> Best regards,
> Pasi

Thanks for the review!

How about if we change the sentence:

"In practice, this hash has been generated using MD5."

into:

"In practice, this hash has been generated using MD5.  Any similar
one-way hash function could be used instead without impacting
interoperability since the hash value is checked by the same host who
generated it."

Would that be better?

-- 
Wesley M. Eddy
Verizon Federal Network Systems

_______________________________________________
tcpm mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/tcpm