Subject: [secdir] secdir review of draft-bryan-http-digest-algorithm-values-update-03

From: Radia Perlman <[email-masked]>
Date: Fri, 18 Dec 2009 19:42:00 -0800

I have reviewed this document as part of the security directorate's 
ongoing effort to review all IETF documents being processed by the 
IESG.  These comments were written primarily for the benefit of the 
security area directors.  Document editors and WG chairs should treat 
these comments just like any other last call comments.

This document just updates the HTTP digest algorithm values, and as such 
doesn't really have security
considerations.

First a question...this isn't a cryptographic checksum, and it might be 
nice if the document said what
its purpose is. I assume it's for caching, so that you can quickly check 
if a page has changed?

Now not to pick on this spec, but perhaps something IETF might
consider, two issues:

Terminology issue: even though people routinely use the terminology 
"SHA-256", perhaps it's time to also include
the version of SHA, as in SHA-2-256, since other versions of SHA might 
have overlapping sizes with
SHA-1 and SHA-256.

And having a registry for each algorithm for each protocol seems 
unwieldly---each time a new algorithm happens,
does it mean a bunch of specs have to come out with an update document 
like this one? Could it instead
be a single registry that all specs point to?

Radia

---

From: Anthony Bryan <[email-masked]>
Date: Sat, 19 Dec 2009 18:25:09 -0500

Hi Radia, thanks for the review.

On Fri, Dec 18, 2009 at 10:42 PM, Radia Perlman <[email-masked]> wrote:
> I have reviewed this document as part of the security directorate's ongoing
> effort to review all IETF documents being processed by the IESG.  These
> comments were written primarily for the benefit of the security area
> directors.  Document editors and WG chairs should treat these comments just
> like any other last call comments.
>
> First a question...this isn't a cryptographic checksum, and it might be nice
> if the document said what
> its purpose is. I assume it's for caching, so that you can quickly check if
> a page has changed?

The newest version is hopefully more clear:

Abstract

   The IANA registry named "Hypertext Transfer Protocol (HTTP) Digest
   Algorithm Values" defines values for digest algorithms used by
   Instance Digests in HTTP.  Instance Digests in HTTP provide a digest,
   also known as a checksum or hash, of an entire representation of the
   current state of a resource.  This draft adds new values to the
   registry and updates previous values.

This can be found here, and includes all changes made in response to
comments during last call:

http://metalinks.svn.sourceforge.net/viewvc/metalinks/internetdraft/draft-bryan-http-digest-algorithm-values-update-04.txt

> the version of SHA, as in SHA-2-256, since other versions of SHA might have
> overlapping sizes with
> SHA-1 and SHA-256.

Secure Hash Standard (SHS), which my draft references, and other RFCs
seem to use this terminology:

"This Standard specifies five secure hash algorithms, SHA-1, SHA-224,
SHA-256, SHA-384, and SHA-512."

(Sometimes, without the "-", as in "SHA256").

It might be confusing to use other terminology?

> does it mean a bunch of specs have to come out with an update document like
> this one? Could it instead

Both registries appear to be updated rarely, if ever.

I've contacted the authors of the original RFCs which created the
registries. It would be nice to know what the reasons were for
creating a second similar registry.

>From looking at the two, maybe the first registry (Hypertext Transfer
Protocol (HTTP) Digest Algorithm Values) didn't contain enough
information - it also has looser registration requirements
("Specification Required").
The second registry (Hash Function Textual Names) has the OID field
("The Object Identifier (OID) of the hash function as used in X.509
certificates.") and requires "Standards-track RFCs which update or
obsolete [RFC3279]"

-- 
(( Anthony Bryan ... Metalink [ http://www.metalinker.org ]
  )) Easier, More Reliable, Self Healing Downloads