Subject: [TLS] draft-ietf-tls-encrypt-then-mac

From: Watson Ladd <[email-masked]>
Date: Fri, 11 Apr 2014 08:55:28 -0700

Dear all,

Professor Gutman has generously cleaned up the mess left by this WG.
The draft looks good to me. Before you all go pontificate about TLS
1.3, I strongly suggest fixing TLS 1.2, and I think this draft solves
one of the three problems out there.

(We still need a 1/n-1 draft for TLS 1.0, and a RC4 die-die-die draft.
But UTA seems to be doing that, except no one actually wants to kill
RC4)

Sincerely,
Watson Ladd

---

From: Andrei Popov <[email-masked]>
Date: Fri, 11 Apr 2014 17:24:02 +0000

> (We still need a 1/n-1 draft for TLS 1.0, and a RC4 die-die-die draft.

Here's an RC4 die-die-die draft: http://tools.ietf.org/id/draft-popov-tls-prohibiting-rc4-01.txt

RC4)

I think a lot of people want to kill RC4. The problem is, some say: "because publishing an RC4 die-die-die RFC will not kill RC4 overnight, why bother with the RFC". IMHO, the RFC is still needed, both as a signal to the industry, and as a matter of routine maintenance of the protocol.

Cheers,

Andrei

-----Original Message-----
From: TLS [mailto:[email-masked]] On Behalf Of Watson Ladd
Sent: Friday, April 11, 2014 8:55 AM
To: [email-masked]
Subject: [TLS] draft-ietf-tls-encrypt-then-mac

Dear all,

Professor Gutman has generously cleaned up the mess left by this WG.
The draft looks good to me. Before you all go pontificate about TLS 1.3, I strongly suggest fixing TLS 1.2, and I think this draft solves one of the three problems out there.

Sincerely,
Watson Ladd

_______________________________________________
TLS mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/tls

---

From: "Salz, Rich" <[email-masked]>
Date: Fri, 11 Apr 2014 13:26:22 -0400

> IMHO, the RFC is still needed, both as a signal to the industry, and as a matter of routine maintenance of the protocol.

Yes.  And also so ISP's have someplace they can point their customers to.  (Arg, "at which they can point their customers"?  Yuk)

	/r$

--  
Principal Security Engineer
Akamai Technology
Cambridge, MA

---

From: Eric Rescorla <[email-masked]>
Date: Fri, 11 Apr 2014 10:29:13 -0700

Speaking as an individual, I agree with this as well.

Speaking as chair, we've opted to let UTA handle this, but if they don't
think it's in their scope, Andrei please bring it back to TLS and we will
reconsider it here.

-Ekr

On Fri, Apr 11, 2014 at 10:26 AM, Salz, Rich <[email-masked]> wrote:

> > IMHO, the RFC is still needed, both as a signal to the industry, and as
> a matter of routine maintenance of the protocol.
>
> Yes.  And also so ISP's have someplace they can point their customers to.
>  (Arg, "at which they can point their customers"?  Yuk)
>
>         /r$
>
> --

---

From: Andrei Popov <[email-masked]>
Date: Fri, 11 Apr 2014 18:04:21 +0000

I believe UTA has added some text describing RC4 vulnerabilities to one of their BCP I-Ds. Which is a good thing, but I think the TLS WG should still consider fully deprecating RC4.

Since the previous RC4 deprecation draft expired, I re-submitted it: http://tools.ietf.org/html/draft-popov-tls-prohibiting-rc4-02

Thanks,

Andrei

From: Eric Rescorla [mailto:[email-masked]]
Sent: Friday, April 11, 2014 10:29 AM
To: Salz, Rich
Cc: Andrei Popov; [email-masked]
Subject: Re: [TLS] draft-ietf-tls-encrypt-then-mac

-Ekr

        /r$

_______________________________________________
TLS mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/tls

---

From: Alyssa Rowan <[email-masked]>
Date: Fri, 11 Apr 2014 19:12:16 +0100

On 11/04/2014 19:04, Andrei Popov wrote:

> I believe UTA has added some text describing RC4 vulnerabilities to
> one of their BCP I-Ds. Which is a good thing, but I think the TLS
> WG should still consider fully deprecating RC4.
> 
> Since the previous RC4 deprecation draft expired, I re-submitted
> it: http://tools.ietf.org/html/draft-popov-tls-prohibiting-rc4-02

I think the WG should adopt this draft. RC4 is critically weak, or
worse. +1

- -- 
/akr

---

From: Yoav Nir <[email-masked]>
Date: Fri, 11 Apr 2014 21:30:08 +0300

On Apr 11, 2014, at 9:12 PM, Alyssa Rowan <[email-masked]> wrote:

> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA512
> 

-1 

RC4 is also used in other protocols such as SSH (See RFC 4345), and the (in)security considerations apply there as well. So I think this document should proceed as AD-sponsored individual or a CFRG document, and not specifically a TLS document.

It is strange that the IETF would publish a die-die-die document only three years after RFC 6229, but that’s life, I guess.

Yoav

---

From: "Paterson, Kenny" <[email-masked]>
Date: Fri, 11 Apr 2014 18:35:53 +0000

On 11/04/2014 19:30, "Yoav Nir" <[email-masked]> wrote:

>RC4 is also used in other protocols such as SSH (See RFC 4345), and the
>(in)security considerations apply there as well. So I think this document
>should proceed as AD-sponsored individual or a CFRG document, and not
>specifically a TLS document.

I tend to disagree. RC4 is *widely* used in TLS, and the specific attacks
referred to in Andrei's draft are for TLS. It's the TLS WG's
responsibility to clean up its own problems.

>It is strange that the IETF would publish a die-die-die document only
>three years after RFC 6229, but that¹s life, I guess.

That's irrelevant. The state of cryptanalytic knowledge changes, and IETF
has to respond to that.

Cheers,

Kenny

---

From: Yoav Nir <[email-masked]>
Date: Fri, 11 Apr 2014 23:50:19 +0300

> responsibility to clean up its own problems.

Previous deprecation documents were individual AD-sponsored. The exception was DES (the one with “die-die-die” in the filename), which was specific to Kerberos.

AFAICT RC4 is used in TLS, SSH (a little bit), and WEP. WEP is deprecated altogether, but we might as well deprecate it for SSH (and any uses I don’t know about) as well.

> That's irrelevant. The state of cryptanalytic knowledge changes, and IETF

Reading the security considerations of 6229, the authors did not think it was secure at the time. I’m kind of baffled by the “don’t use this, but if you do, might as well make it correct, so here’s some test vectors” message.

Yoav

---

From: Stephen Farrell <[email-masked]>
Date: Fri, 11 Apr 2014 22:03:54 +0100

FWIW, I don't mind much if this is done in TLS or AD sponsored
but have a slight preference for it being a WG document since
that's easier (for me:-).

I'll fwd something from this thread to the openssh list and if
they wanna join the game we can see how to play it from there.

Cheers,
S.

---

From: Michael D'Errico <[email-masked]>
Date: Sat, 12 Apr 2014 17:01:52 -0700

> Professor Gutman has generously cleaned up the mess left by this WG.

Would you please stop with the divisive comments?  Peter Gutmann is a
member of this WG too, so in fact the WG is cleaning up after itself.

Mike