[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: AH-MD5
hugo@watson.ibm.com says:
> Also, if you read my original note it says:
>
> In my opinion, if the IETF goes for a "standard" prepend-MD5
> they should define explicitely
> that the length parameter is prepended to the computation
> (say after the key) and not left to the "luck" of having or not
> the length in a fixed offset in the information (as it "happens"
> to be in the IP header).
>
> If you do that, then my objection is gone.
In fact, because you and Ted Tso asked, we've already inserted that
sort of language into the next draft. As I said before, I thought the
suggestion was very good. We are being quite explicit in the document
that the length is a necessary part of the security. The language
will make it very clear that any system which does not have the length
at a fixed position in the block isn't secure.
I have no objections to the addition of any further explanatory
language that might be needed.
Given that the language is indeed going to be in the MD5 documents,
are there further objections or comments on the documents as written
thus far? I was expecting far more commentary, frankly. Surely someone
at least objects to some of our grammar or phrasing? (The IETF is not
known for its passive acceptance of anything...)
Perry