Secdir last call review of draft-ietf-kitten-pkinit-alg-agility-04

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



Reviewer: Takeshi Takahashi
Review result: Ready

I do not see any serious issues on this draft and enjoyed reading it.
I have only minor questions for the purpose of deepening my understanding of
the draft.

1. In section 5, regarding the The TD-CERT-DIGEST-ALGORITHMS-Data message, who
embed the rejectedAlgorithm field? If it will be the KDC, why does the KDC need
to fill and distribute this information to the others?

2. In section 8 (security consideration), it is stated that "to do otherwise
allows an active attacker to perform a downgrade attack". In my understanding
of the draft, arbitrary algorithm could be used (if the negotiation reaches
agreements). I wonder if there is any mechanism that discourages the
negotiation of using insecure algorithms.  For instance, the list of algorithms
that must be treated with care could be listed somewhere?

Thank you, and kind regards,
Take





[Index of Archives]     [IETF Annoucements]     [IETF]     [IP Storage]     [Yosemite News]     [Linux SCTP]     [Linux Newbies]     [Mhonarc]     [Fedora Users]

  Powered by Linux