[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
RE: [Sterman Issue 7] Message Authenticator: Options
If you allow HMAC-MD5 people will keep using it. If HMAC-MD5 is an issue,
then in my opinion don't provide that option.
Besides folks already have Message-Authenticator that they can use.
> -----Original Message-----
> From: Glen Zorn (gwz) [mailto:firstname.lastname@example.org]
> Sent: Monday, November 22, 2004 4:37 PM
> To: 'Avi Lior'; email@example.com
> Subject: RE: [Sterman Issue 7] Message Authenticator: Options
> Avi Lior <> wrote:
> > -Will keywrap be ready in time?
> > This is important but the authors feel that it is ready to go.
> > However, note that Keywrap allows Message-Authentication-Code to
> > HMAC-MD5 isn't this a problem?
> The use of HMAC-MD5 is optional and included just for ease of
> transition. It is _not_ required by the draft; if you like,
> we can add text to the Security Considerations section
> deprecating its use (or even remove it altogether -- I have
> no problem with that).
> > Your comments and opinion would be appreciated.
> > Avi
> Hope this helps,
> Why is it that most of the world's problems can't be solved by simply
> listening to John Coltrane? -- Henry Gabriel
to unsubscribe send a message to firstname.lastname@example.org with
the word 'unsubscribe' in a single line as the message text body.