Fix: #1954. No normative text in security considerations.

[ioggstream]

This PR

• no normative text in security considerations.
  Fix No normative statements in Security Considerations #1954

[LPardue]

Thanks.

Seeing it like this, is there even a need to say anything here? The referenced sections apply to the usage of digest and don't appear to add any further insight or considerations when used with Signature.

@jricher WDYT about just deleting the two sentences and not adding anything more?

[jricher]

I actually like the cross-reference here, I would keep it this way.

[LPardue]

Interesting. If someone is using Digests with signature, they should really apply all the recommondations and apply all the considerations of the document. There seems to me no need to call out any particular section as unique to Signatures, unless there is something to say about why. Is that the case here?

The rest of this section does achieve the goal of signature-specific considerations. It's just these that stick out to me.

[ioggstream]

@LPardue {{algorithms}} actually references a signature-related normative text, so I think it should stay. The TLS part in 2022 is probably redundant for a careful reader.

Can we agree on removing the transport layer text and leave the {{algorithms}} reference? cc: @jricher

[jricher]

I still think they can both stay, but at this stage I'll leave it up to your discretion if you think it is clearer without them.

[LPardue]

So reading the text in {{algorithms}} the relevant part seems to be about saying signatures is a potential adversarial setting.

But we already have the Algorithm Agility security consideration section, which now contains nice text about considerations for choosing secure or insecure algorithms.

So instead I would say

"Signatures are likely to be deemed an adversarial setting when applying integrity digests; see {{algorithm agility}}."

And still drop the part about transport integrity.

[ioggstream]

deal!

[jricher]

I actually like the cross-reference here, I would keep it this way.