Subject: [Curdle] Review of draft-kaduk-kitten-des-des-des-die-die-die-01

From: Greg Hudson <[email-masked]>
Date: Wed, 17 May 2017 11:54:03 -0400

I have reviewed this draft and have no blocking objections.  Some
non-blocking, editorial notes:

Interoperability concerns are listed last for RC4, but second out of
three subsections for DES3.

Section 5.2, "Modern encryption types such as [...] use" should have a
comma before "such as" and before "use".

Section 5.2, "It is also best practice when [...], to" should have a
comma before "when".  Also, "it is also best practice" doesn't seem
right.

Section 5.3, "Because [...], this means that these application servers
also possess" should omit "this means that".  I would also remove the
parenthetical for that sentence.

Section 5.4, "cross-realm situations" should perhaps be "cross-realm
deployments".

Section 6, in "ample justification for deprecating their use", "their"
appears to refer back to "The flaws", which doesn't seem quite right.

Section 6, "blocksize" should be "block size".

Section 6.1, "[nfold] is known not to provide effective mixing of the
input bits" is not backed up by a reference.  (I don't know of a
reference.)

---

From: Benjamin Kaduk <[email-masked]>
Date: Wed, 17 May 2017 21:10:05 -0500

Hi Greg,

Thanks for the review.  Could you clarify which version you
reviewed?
(https://tools.ietf.org/html/draft-kaduk-kitten-des-des-des-die-die-die-01
or
https://tools.ietf.org/html/draft-ietf-curdle-des-des-des-die-die-die-00
?)

> input bits" is not backed up by a reference.  (I don't know of a

The other items seem clearly editorial.
For this one, do you think I should look harder for a reference, or
drop down to "is believed not to provide"?

Thanks again,

Ben

---

From: Greg Hudson <[email-masked]>
Date: Wed, 17 May 2017 23:26:33 -0400

> https://tools.ietf.org/html/draft-ietf-curdle-des-des-des-die-die-die-00

I think the former.  I took a look at
draft-ietf-curdle-des-des-des-die-die-die-00 just now, and it looks the
same to me.

I do see a typo "implemneted" in section 6.2.

---

From: Benjamin Kaduk <[email-masked]>
Date: Thu, 25 May 2017 22:53:28 -0500

> draft-ietf-curdle-des-des-des-die-die-die-00 just now, and it looks the

Thanks.

> I do see a typo "implemneted" in section 6.2.

Staged a fix.

-Ben

---

From: Benjamin Kaduk <[email-masked]>
Date: Thu, 25 May 2017 23:49:08 -0500

> three subsections for DES3.

To some extent the section structure for the two ciphers are
completely different, but I do see some argument for putting interop
concerns last in both cases; I'll make that change.

> comma before "such as" and before "use".

I think this is technically a stylistic matter, but my normal
tendency is to overuse commas (so that I have to consciously correct
for it); I'm happy to put them back.

> comma before "when".  Also, "it is also best practice" doesn't seem

Sure, these commas need to come in pairs.  Is dropping to just "it
is best practice" enough of an improvement to make you happy?
(There's not really a preceeding instance that would make the "also"
useful.)

> parenthetical for that sentence.

Done.

> Section 5.4, "cross-realm situations" should perhaps be "cross-realm

Sure.

> appears to refer back to "The flaws", which doesn't seem quite right.

I think "their" was trying to be representing the plural "triple-DES
based encryption types".  That's rather clunky, so I'll just go for
"deprecating its use", which I think is sufficiently unambiguous.

> Section 6, "blocksize" should be "block size".

Yup.

> input bits" is not backed up by a reference.  (I don't know of a

I don't know of a reference, either.  I don't really want to drop
down to a weaker statement like "not expected to provide effective
mixing", as I have a vague memory of someone telling me that (e.g.)
it was hard to get things with the high bit set when an ASCII
password is used.  If the lack of reference becomes problematic for
IETF/IESG review we can certainly revisit the question (and try to
get something closer to primary data).

-Ben

---

From: Greg Hudson <[email-masked]>
Date: Sat, 27 May 2017 11:24:51 -0400

> (There's not really a preceeding instance that would make the "also"

How to use "best practice" grammatically seems to be a matter of some
debate; for me personally, it looks wrong without an article.  "It is
the best practice when [...]" would look okay to me.  As I noted before,
this is a non-blocking objection, and you should feel free to let the
RFC editor worry about this stuff.