Subject: [Ietf-krb-wg] In support of draft-lha-des-die-die-die-01.txt

From: Sam Hartman <[email-masked]>
Date: Thu, 29 Oct 2009 14:51:24 -0400 (EDT)

Hi.  I had previously stated my position as agreeing with getting rid
of DES.  However I finally got around to Love's draft and want to
support the specific text he wrote.  We should publish this now,
either as a WG or individual document, whichever is faster.
_______________________________________________
ietf-krb-wg mailing list
[email-masked]
https://lists.anl.gov/mailman/listinfo/ietf-krb-wg

---

From: Tom Yu <[email-masked]>
Date: Thu, 29 Oct 2009 15:22:59 -0400

> either as a WG or individual document, whichever is faster.

I also support getting rid of single-DES, and I also support
publishing Love's text.

I think I see some typos here, though:

   Kerberos implementation and deployments SHOULD NOT implement the
   checksum type: CRC, RSA-MD4, RSA-MD4-DES, RSA-MAC, RSA-MAC-K, RSA-
   MD5, RSA-MD5-DES.

should be:

   Kerberos implementation and deployments SHOULD NOT implement the
   checksum type: CRC, RSA-MD4, RSA-MD4-DES, DES-MAC, DES-MAC-K, RSA-
   MD5, RSA-MD5-DES.
_______________________________________________
ietf-krb-wg mailing list
[email-masked]
https://lists.anl.gov/mailman/listinfo/ietf-krb-wg

---

From: Love Hörnquist Åstrand <[email-masked]>
Date: Thu, 29 Oct 2009 12:54:58 -0700

> either as a WG or individual document, whichever is faster.

My document should also update the gss-api kerberos documents, since they are not dependent on Kerberos encryption methods.

Love

---

From: "Henry B. Hotz" <[email-masked]>
Date: Thu, 29 Oct 2009 14:36:38 -0700

> I also support getting rid of single-DES, and I also support

+1
------------------------------------------------------
The opinions expressed in this message are mine,
not those of Caltech, JPL, NASA, or the US Government.
[email-masked], or [email-masked]

---

From: Jeffrey Hutzelman <[email-masked]>
Date: Thu, 29 Oct 2009 23:24:19 -0400

>> I also support getting rid of single-DES, and I also support

OK.  We previously agreed to adopt this document, and I've seen little 
movement since then.  It does not appear to be listed as one of our 
documents; I'll send a message to the secretariat to get that corrected.

love, it sounds like you have some changes you want to make in order to 
update (presumably) RFC1964.  If you can describe what you want to do, 
perhaps we can get a consensus and move this document to WGLC shortly after 
Hiroshima.

-- Jeff

---

From: Love Hörnquist Åstrand <[email-masked]>
Date: Thu, 29 Oct 2009 20:47:08 -0700

29 okt 2009 kl. 20:24 skrev Jeffrey Hutzelman:

> love, it sounds like you have some changes you want to make in order to update (presumably) RFC1964.  If you can describe what you want to do, perhaps we can get a consensus and move this document to WGLC shortly after Hiroshima.

Deprecate use of DES in Kerberos GSS-API just like its done for Kerberos.

Love

---

From: Tom Yu <[email-masked]>
Date: Thu, 29 Oct 2009 23:57:03 -0400

> Deprecate use of DES in Kerberos GSS-API just like its done for Kerberos.

Would you also deprecate the related hash algorithms for RFC 1964?
What would we replace them with?
_______________________________________________
ietf-krb-wg mailing list
[email-masked]
https://lists.anl.gov/mailman/listinfo/ietf-krb-wg

---

From: Love Hörnquist Åstrand <[email-masked]>
Date: Thu, 29 Oct 2009 21:19:32 -0700

> Would you also deprecate the related hash algorithms for RFC 1964?

Does it make any sense to keep them ? RFC 1964 is good, its just that crypto parts are no longer useful, DES + md2 make no sense.

> What would we replace them with?

We would use arcfour, des3 and cfx and the crypto in RFC 1964 would no longer be used.

Love