That registry was created 11 months ago. This document has been around
for 6+ years, and the protocol even longer. Moreover, that registry
specifically states that it's for PKIX, and modifying that registry
requires a document to update the PKIX document, which probably requires
action from the PKIX working group. Now, the latter issue might not
be as big a deal, but the former certainly is.
Not only the names of the hashes, but the contents of the list, are different.
So it would just be easier to have an OpenPGP hash registry for the list
of hashes that OpenPGP understand, and if the content of that list
mirror what PKIX understand, well, so be it. But I doubt the PKIX people
necessarily want to add RIPEMD or some other "weird" hashes to their
lists -- that could cause a LOT of confusion.
now, perhaps that registry is misnamed and should be "pkix hash function
textual names"? but that's a different disucssion.
-derek
Quoting Miguel Garcia <[EMAIL PROTECTED]>:
What a pity... that registry was precisely created to avoid what we
are getting into: duplication of registries because of the upper and
lower cases, hyphen, etc.
/Miguel
David Shaw wrote:
One problem is that the names do not match exactly. For example,
OpenPGP uses the text name "SHA512", but that registry uses "sha-512",
which lowercase and with a hyphen. This is significant as one of the
OpenPGP message formats uses the hash name string to match on. Using
that registry would involve a lot of confusing explanation in the
OpenPGP draft to tell people to uppercase the names and remove
hyphens.
David
On Tue, Mar 27, 2007 at 02:58:27PM +0300, Miguel Garcia wrote:
Hi Sam:
Can you elaborate a bit the reason you think these are different hashes?
For example: the OpenPGP draft uses an MD5 hash. The OID value
defined in Section 5.2.2 matches the OID of the MD5 hash defined in
the mentioned IANA registry. The same is applicable to SHA-1,
SHA224, SHA256, SHA384, and SHA512.
To me the look like they are the same objects that represent the
same "thing".
/Miguel
Sam Hartman wrote:
http://www.iana.org/assignments/hash-function-text-names is an
inappropriate registry for openpgp. The set of hashes there is not
the same as the set of openpgp hashes.
--
Miguel A. Garcia tel:+358-50-4804586
Nokia Research Center Helsinki, Finland
--
Derek Atkins 617-623-3745
[EMAIL PROTECTED] www.ihtfp.com
Computer and Internet Security Consultant
_______________________________________________
Gen-art mailing list
[email protected]
https://www1.ietf.org/mailman/listinfo/gen-art
