[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: keyed-MD5 placement of secret
hugo@watson.ibm.com says:
> Exactly! This is why you want an authentication function whose security
> is independent of the particular usage/scenario/assumptions.
You are asking that we prepend the length to packets that already
specify their length at a fixed location. I don't understand why we
need that. The specification is "keyed MD5 with length at a fixed
point in the packet to prevent appending attacks". We've got that. I
see no cryptographic reason to include the length twice -- the two are
identical. From a software engineering standpoint there is no reason
that I can see, either -- there is no code sharing between the kernel
and your SNMP implementation, for instance.
Remember that no security function can operate for all possible
scenarios. Our security function works fine for our scenario.
Perry
References: