Subject: [Cfrg] Use of the term "deprecated"

From: "Erik Andersen" <[email-masked]>
Date: Fri, 8 Dec 2017 10:02:47 +0100

In the smart grid security standards the term deprecated is used for certain
cryptographic algorithms, such as SHA-1, instead of disallowing them. NIST
in SP 800-57, Part 1 Revision 4 has stopped using the term deprecated.

What is the general feeling among  list members on using the term deprecated
on cryptographic algorithms?

Erik

---

From: "Panos Kampanakis (pkampana)" <[email-masked]>
Date: Fri, 8 Dec 2017 15:31:29 +0000

Hi Erik,

For what it is worth, our "subjective" Cisco approach includes the term Legacy which is equivalent to Deprecated. The definition is "Legacy algorithms provide a marginal but acceptable security level. They should be used only when no better alternatives are available, such as when interoperating with legacy equipment. It is recommended that these legacy algorithms be phased out and replaced with stronger algorithms." In the table https://www.cisco.com/c/en/us/about/security-center/next-generation-cryptography.html#2 you will see we are flagging SHA1 as legacy, MD5 as avoid.

Rgs,
Panos

From: Cfrg [mailto:[email-masked]] On Behalf Of Erik Andersen
Sent: Friday, December 08, 2017 4:03 AM
To: Cfrg <[email-masked]>
Cc: Carsten Strunge <[email-masked]>
Subject: [Cfrg] Use of the term "deprecated"

In the smart grid security standards the term deprecated is used for certain cryptographic algorithms, such as SHA-1, instead of disallowing them. NIST in SP 800-57, Part 1 Revision 4 has stopped using the term deprecated.

What is the general feeling among  list members on using the term deprecated on cryptographic algorithms?

Erik

---

From: "Blumenthal, Uri - 0553 - MITLL" <[email-masked]>
Date: Fri, 8 Dec 2017 15:44:47 +0000

The term “Legacy” does not carry as much strength as the term “Deprecated”. So I strongly (pun intended) suggest using the term “Deprecated” to emphasize the fact that the algorithms in question should not be used if at all possible.

--

Regards,

Uri Blumenthal

From: Cfrg <[email-masked]> on behalf of "Panos Kampanakis (pkampana)" <[email-masked]>
Date: Friday, December 08, 2017 at 10:32
To: Erik Andersen <[email-masked]>, CFRG <[email-masked]>
Cc: Carsten Strunge <[email-masked]>
Subject: Re: [Cfrg] Use of the term "deprecated"

Hi Erik,

For what it is worth, our “subjective” Cisco approach includes the term Legacy which is equivalent to Deprecated. The definition is “Legacy algorithms provide a marginal but acceptable security level. They should be used only when no better alternatives are available, such as when interoperating with legacy equipment. It is recommended that these legacy algorithms be phased out and replaced with stronger algorithms.” In the table https://www.cisco.com/c/en/us/about/security-center/next-generation-cryptography.html#2 you will see we are flagging SHA1 as legacy, MD5 as avoid. 

Rgs,

Panos

Erik