[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Changes in AP draft
> From: "William Allen Simpson" <bill.simpson@um.cc.umich.edu>
> If you have a proposal for changes to language, please post it to the
> list, so that Ran can make them.
>
To follow my own advice:
There is an error in your Appendix on keyed-MD5. The secret should be
both before and after the protected data.
Otherwise, "inverse MD5" could unroll the data hash, and learn the hash
of the secret, allowing spoofing of the authentication.
In response to Ran's list comment that MD5 is too slow, why not use MD4?
Any speed tests there? Is it enough faster?
There are several typos in the appendix, including a missing period.
I'd split the reference, method of selecting a key, calculation, and
specification of invariant fields into separate paragraphs.
The information on what is protected should probably be in its own
section. Maybe the description of invariant fields would go there, too.
Bill.Simpson@um.cc.umich.edu
Follow-Ups: