Re: RFC 4556 DH parameter oddities
Greg Hudson <[email protected]>
| Newsgroups | gmane.ietf.krb-wg |
|---|---|
| Message-ID | <[email protected]> |
On 03/08/2012 07:28 PM, Tom Yu wrote: > How do we want to handle this? For interop purposes, it should be > safe to accept domain parameters if they lack a Q value as long as P > matches one of the well-known safe primes. If I understand correctly, I think what we want to do is: * State the Q values for the affected groups, and reiterate that implementations MUST send Q values when using those groups. * Say that some implementations are known to use these groups without sending Q values, and say that implementations MAY choose to accept DomainParameters values with no Q value. I don't think we'd want to more strongly require implementations to accept Q-less DomainParameters values, since that could prohibit the use of off-the-shelf CMS implementations. From a process perspective, I'm not sure how much of the above we can say in an errata. _______________________________________________ ietf-krb-wg mailing list [email protected] https://lists.anl.gov/mailman/listinfo/ietf-krb-wg