[Date Prev] | [Thread Prev] | [Thread Next] | [Date Next] -- [Date Index] | [Thread Index] | [List Home]
Subject: Re: [camp-comment] 4.1.2 Validating Integrity
Patrick, This comment has been captured as Jira issue CAMP-102 and will be processed by the TC. We will inform you when this issue has been resolved. ~ gp On 9/5/2013 11:24 AM, Patrick Durusau
wrote:
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Greetings! The first paragraph of 4.1.2 Validating Integrity reads: ***** A PDP MAY contain a manifest file, named camp.mf, at the root of the archive. [PDP-06] This file contains SHA256 [SHA256] digests of some or all files in the package. A Provider SHOULD reject a PDP if any digest listed in the manifest does not match the computed digest for that file in the package. [PDP-07] ***** I take the implication of: "This file contains SHA256 [SHA256] digests of some or all files in the package." to be that a manifest file contains only SHA256 digests. And any PDF with a listed digest that does not match a computed SHA256 digest for a file in the package should be rejected. Yes? The reason I ask is that 6.1 Transfer Protocol: ***** TLS 1.1 [RFC4346] SHALL be implemented by the Provider. [PR-41] TLS 1.2 [RFC5246] is RECOMMENDED.[PR-42] When TLS is implemented, the following cipher suites are RECOMMENDED to ensure a minimum level of security and interoperability between implementations: TLS_RSA_WITH_AES_128_CBC_SHA (mandatory for TLS 1.1/1.2) [PR-43] TLS_RSA_WITH_AES_256_CBC_SHA256 (addresses 112-bit security strength requirements) [PR-44] ***** may cause some confusion. True, one requirement is for transport and the other for digests but why permit a weaker transport protocol than is used for digests? Second, my bad on my RFC 4346 comment yesterday in not noticing it has been obsoleted by RFC5246. Obsolete RFCs should not be used as normative references. I will supplement that comment. BTW, SHA-3 is in the process of being published, as your encryption specialists already know: http://www.nist.gov/itl/csd/sha-100212.cfm Hope everyone is having a great day! Patrick - -- Patrick Durusau patrick@durusau.net Technical Advisory Board, OASIS (TAB) Former Chair, V1 - US TAG to JTC 1/SC 34 Convener, JTC 1/SC 34/WG 3 (Topic Maps) Editor, OpenDocument Format TC (OASIS), Project Editor ISO/IEC 26300 Co-Editor, ISO/IEC 13250-1, 13250-5 (Topic Maps) Another Word For It (blog): http://tm.durusau.net Homepage: http://www.durusau.net Twitter: patrickDurusau -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.11 (GNU/Linux) Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/ iQIcBAEBAgAGBQJSKMxPAAoJEAudyeI2QFGo68MP/0JzV7b59jAJvzKQz1iFuZmk 0n9pTXA0VkFBrn/Ti9AmdpjwPwc5t9hVAFw+uyWwCNpAFO0ZSo6SwO3yUMLyFjG6 l6FNzJ7w2976uR48/Ze7mi5xt6HFR//sS3p/LpVhbNohF+zeAyWQKKFes8lLiHwT FGjDrdpjXAW6m6Ifm6vN8kp8Ix11RiuMzBLmFmSWZLK6HPbqpsYLmNnq7D6Lsoae o3tSMInTuHdZ3U3mOeN/geatHMfV72j4qpwP32cn+459oXPPmclCv74kEc3yJJI0 81R10VR488Bog+qOs+nxJjl3Wss6RhAZReXVCMs/htItWy+oslpE+ccvOkwhYMyW auMHH+ZMUKTiXd/cJdCzaLbaNKI5z6dnsWcJ3ulRrfijqJodZE4WTQqIiUXw/wbP vwMSZz+E88EQq6C2AqfzFDYeVDRpdTC2VjrdJHPDnVIw7qdoeTl2u9D6bWEeuIrq Jp5LUmDBBIb5CnTdOiG72O0c4vDXb5icOJxfvfT4OyeiP+RKPG0vWacCdx9Su25F 656Y6n7J6qJuJ9OjPirVmGoyXNJY8AVoRBqjSqZAnn06OaH5Q96AKe4+y+RvkP/O f7R6lUtOYMC2LGUD0KKpKdO2EMHrH6b+noO1JreuaX2phUv8oMR9bxA7iAfG2p+G jEkQy5HzYAtSdaullVMA =JLSj -----END PGP SIGNATURE----- -- This publicly archived list offers a means to provide input to the OASIS Cloud Application Management for Platforms (CAMP) TC. In order to verify user consent to the Feedback License terms and to minimize spam in the list archive, subscription is required before posting. Subscribe: camp-comment-subscribe@lists.oasis-open.org Unsubscribe: camp-comment-unsubscribe@lists.oasis-open.org List help: camp-comment-help@lists.oasis-open.org List archive: http://lists.oasis-open.org/archives/camp-comment/ Feedback License: http://www.oasis-open.org/who/ipr/feedback_license.pdf List Guidelines: http://www.oasis-open.org/maillists/guidelines.php Committee: http://www.oasis-open.org/committees/camp Join OASIS: http://www.oasis-open.org/join/ |
[Date Prev] | [Thread Prev] | [Thread Next] | [Date Next] -- [Date Index] | [Thread Index] | [List Home]