Re: [Cfrg] What crypto algorithm is referenced most in RFCs?

On 6/14/11 2:16 AM, Joachim Strömbergson wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> Aloha!
>
> On 2011:06:13 16:04, David McGrew wrote:
>> That last page can be used to answer the question in the subject line.
>> (Hint: it is not something most of us probably recommend anymore.)
>
> I was amazed that there were so many of those drafts that are in
> standards track. Drafts in informational track describing uses of
> insecure algorithms is imho ok, since they document a practice.
> Similarly, RFCs are a done deal and if they are a standard RFC must be
> replaced by newer RFCs to fix security issues.
>
> But in 2011 writing a draft for standards track that includes known
> insecure, broken algorithms?

Somebody has asked for draft that says don't use RC4.  I'm really busy 
but would gladly help deprecate RFC cipher suites in TLS. Unless of 
course, I'm totally wrong and we should keep them....

> Would it be fruitful to browse the list try and identify the most
> pressing cases and try to convince the authors that they should mend
> their ways?

Actually, it would.

spt

> - --
> Med vänlig hälsning, Yours
>
> Joachim Strömbergson - Alltid i harmonisk svängning.
> ========================================================================
> Kryptoblog - IT-säkerhet på svenska
> http://www.strombergson.com/kryptoblog
> ========================================================================
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.11 (Darwin)
> Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/
>
> iEYEARECAAYFAk32/K0ACgkQZoPr8HT30QF7lACfSUrUM2Ue5RDfK9CZ7379LaSS
> mn4AnRgV7Q37ZaUfwm4gzGdODQOMFwOa
> =vQLC
> -----END PGP SIGNATURE-----
> _______________________________________________
> Cfrg mailing list
> Cfrg@irtf.org
> http://www.irtf.org/mailman/listinfo/cfrg