Publication updage: two draft-standards
As 'publications' go, this is really scraping the bottom of the barrel. Internet Drafts (such as these) are considered works-in-progress, can be submitted by anybody and their grandmother, and expire in six months. They are really, really, not considered a big deal by anyone familiar with the process. But, they have one redeeming feature: one can blog about them very quickly.
So: please allow me to announce that for reasons I cannot explain, I have submitted two Internet Drafts to the IETF:
https://datatracker.ietf.org/doc/draft-herzog-setkey/
https://datatracker.ietf.org/doc/draft-herzog-static-ecdh/
That is all.
Passive set members
Are there really passive set members in practice? One of the challenges I've had with pay-per-view streaming video is the control channel: those watching the movie want to pause, rewind, fast-forward, jump around, drag the slider... and all this has to be represented back to the server, since we neither trust the client nor consider it very bright.
Separately: if a member appears in both active and passive fields, it MUST be considered active. If most implementations consider it active, as you recommend, and a few do otherwise, I think you'll find exploitable bugs fairly quickly.
...and as to ECFH, I wish there were more to say than "use a fresh ukm for each message." I fear that small counters will come back to bite users of this system, but have no better advice to give.
Yes, but
...If a member appears in both active and passive fields, it MUST be considered active. If most implementations consider it active, as you recommend, and a few do otherwise, I think you'll find exploitable bugs fairly quickly.
Perhaps, but the 'MUST' is pretty strong: "This word, or the terms "REQUIRED" or "SHALL", mean that the definition is an absolute requirement of the specification." [RFC 2119]. So any implementation that considers such an entity to be 'active' would be out of compliance with the spec.
Or are you suggesting that I should design the spec to minimize bugs, even in non-compliant implementations?
Post new comment