Re: RFC 4556 DH parameter oddities
Jeffrey Hutzelman <[email protected]>
| Newsgroups | gmane.ietf.krb-wg |
|---|---|
| Message-ID | <[email protected]> |
On Fri, 2012-03-09 at 13:17 -0500, Greg Hudson wrote: > On 03/08/2012 07:28 PM, Tom Yu wrote: > > How do we want to handle this? For interop purposes, it should be > > safe to accept domain parameters if they lack a Q value as long as P > > matches one of the well-known safe primes. > > If I understand correctly, I think what we want to do is: > > * State the Q values for the affected groups, and reiterate that > implementations MUST send Q values when using those groups. We can certainly do this in an erratum. > * Say that some implementations are known to use these groups without > sending Q values We can probably do this, too. > , and say that implementations MAY choose to accept > DomainParameters values with no Q value. This I'm less sure about. It strays into modifying the protocol, but it's a small modification that can only increase interoperability. Of course, there's also the question of whether we _want_ to do this. -- Jeff _______________________________________________ ietf-krb-wg mailing list [email protected] https://lists.anl.gov/mailman/listinfo/ietf-krb-wg