Subject: [secdir] SECDIR review of draft-ietf-softwire-v4nlri-v6nh-01

From: Julien Laganier <[email-masked]>
Date: Tue, 16 Dec 2008 15:36:16 +0100

I have reviewed this document as part of the security directorate's  
ongoing effort to review all IETF documents being processed by the  
IESG. These comments were written primarily for the benefit of the  
security area directors. Document editors and WG chairs should treat  
these comments just like any other last call comments.

This draft specifies an extension to encode an IPv6 address in a BGP 
network layer reachability information field when the address family 
identifier is IPv4.

I did not find any security issues with the draft.

--julien

_______________________________________________
secdir mailing list
[email-masked]
https://mailman.mit.edu/mailman/listinfo/secdir
_______________________________________________
secdir mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/secdir

---

From: Stefan Santesson <[email-masked]>
Date: Tue, 16 Dec 2008 15:24:46 +0000

Just a thought where I'm interested what the rest of you lot think.

The issue of using a hash function for its non cryptographic properties has been discussed since last IETF where Eric brought up the issue that we could benefit from  a hash function that is designed to have no security properties.

Another aspect brought up is that we in general are bad to specify what security properties we are relying on when invoking a hash value in a protocol.
E.g. Is it just an identifier used for practical reasons or does it provide pre-image collision protection?

However, if we are expecting protocol designers to define the security properties of hash they rely on, then a common language to express such properties would be most helpful. So I ask myself:

Does one exist?
If not, would it be worth the effort to create/provide one for the sake of documenting the purpose of hash usage in IETF protocols?

Stefan Santesson
Senior Program Manager
Windows Security, Standards

---

From: "Joseph Salowey (jsalowey)" <[email-masked]>
Date: Tue, 16 Dec 2008 09:04:42 -0800

I don't know of any document that enumerates the properties and uses of
a hash function (cryptographic or otherwise).  I was thinking of asking
a similar question because I think it would be useful.   

Cheers,

Joe

> -----Original Message-----
> From: [email-masked] 
> [mailto:[email-masked]] On Behalf Of Stefan Santesson
> Sent: Tuesday, December 16, 2008 7:25 AM
> To: [email-masked]
> Subject: [secdir] Properties of a hash function
> 
> The issue of using a hash function for its non cryptographic 
> properties has been discussed since last IETF where Eric 
> brought up the issue that we could benefit from  a hash 
> function that is designed to have no security properties.
> 
> Another aspect brought up is that we in general are bad to 
> specify what security properties we are relying on when 
> invoking a hash value in a protocol.
> E.g. Is it just an identifier used for practical reasons or 
> does it provide pre-image collision protection?
> 
> However, if we are expecting protocol designers to define the 
> security properties of hash they rely on, then a common 
> language to express such properties would be most helpful. So 
> I ask myself:
> 
> Does one exist?
> If not, would it be worth the effort to create/provide one 
> for the sake of documenting the purpose of hash usage in IETF 
> protocols?
> 
> 
> Stefan Santesson
> Senior Program Manager