Subject: [Curdle] I-D Action: draft-ietf-curdle-des-des-des-die-die-die-01.txt

From: [email-masked]
Date: Tue, 30 May 2017 21:22:41 -0700

A New Internet-Draft is available from the on-line Internet-Drafts directories.
This draft is a work item of the CURves, Deprecating and a Little more Encryption of the IETF.

        Title           : Deprecate 3DES and RC4 in Kerberos
        Authors         : Benjamin Kaduk
                          Michiko Short
	Filename        : draft-ietf-curdle-des-des-des-die-die-die-01.txt
	Pages           : 9
	Date            : 2017-05-30

Abstract:
   The 3DES and RC4 encryption types are steadily weakening in
   cryptographic strength, and the deprecation process should be begun
   for their use in Kerberos.  Accordingly, RFC 4757 is moved to
   Obsolete status, as none of the encryption types it specifies should
   be used, and RFC 3961 is updated to note the deprecation of the
   triple-DES encryption types.

The IETF datatracker status page for this draft is:
https://datatracker.ietf.org/doc/draft-ietf-curdle-des-des-des-die-die-die/

There are also htmlized versions available at:
https://tools.ietf.org/html/draft-ietf-curdle-des-des-des-die-die-die-01
https://datatracker.ietf.org/doc/html/draft-ietf-curdle-des-des-des-die-die-die-01

A diff from the previous version is available at:
https://www.ietf.org/rfcdiff?url2=draft-ietf-curdle-des-des-des-die-die-die-01

Please note that it may take a couple of minutes from the time of submission
until the htmlized version and diff are available at tools.ietf.org.

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/

---

From: Benjamin Kaduk <[email-masked]>
Date: Tue, 30 May 2017 23:26:05 -0500

The main change here is to target BCP instead of Informational.

I think I addressed the other concrete items that came up in the
WGLC review; please let me know if I missed anything.

At this point, I think the only outstanding questions are whether to
remain as targetting BCP vs. standards track, and semi-relatedly
whether to leave the prohibition against using these enctypes as
SHOULD NOT (to match RFC 6649) or go to the stronger MUST NOT.

-Ben

On Tue, May 30, 2017 at 09:22:41PM -0700, [email-masked] wrote:
> _______________________________________________
> Curdle mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/curdle

---

From: "Salz, Rich" <[email-masked]>
Date: Wed, 31 May 2017 12:21:31 +0000

> At this point, I think the only outstanding questions are whether to remain as
> targetting BCP vs. standards track, and semi-relatedly whether to leave the
> prohibition against using these enctypes as SHOULD NOT (to match RFC 6649)
> or go to the stronger MUST NOT.

6649 is BCP, 7465 is standards-track.

I lean towards BCP and SHOULD.

---

From: Daniel Migault <[email-masked]>
Date: Wed, 31 May 2017 12:45:06 +0000

Thank you Benjamin for the update. If MUST NOT cannot be enforced, so realistically SHOULD NOT might be preferred. Or something like REALLY SHOULD NOT from RFC6919 might also be considered.

I am fine either way BCP or standard track. I would like the WG to express its preferences. 

Yours, 
Daniel

---

From: Michiko Short <[email-masked]>
Date: Wed, 31 May 2017 21:29:14 +0000

I agree with SHOULD & BCP. That is the same language and category we used in RFC 6649: Deprecate DES, RC4-HMAC-EXP, and Other Weak Cryptographic Algorithms in Kerberos.

Thanks,
Michiko Short
Program Manager | Authentication Protocols
Windows & Devices Group: OS Security